ci: shard and harden process replay

[daggerhashjack]

Summary

• split process replay into four deterministic GitHub-hosted shards
• make replay case selection, reference handling, and failure reporting explicit and fail-closed
• add private-fixture sanitization and release-validation tooling without publishing or activating pending fixtures
• rebuild tracked x86_64 acados artifacts with non-executable stacks
• update opendbc for Tesla Pre-AP firmware matching

Rollout boundary

This PR is hosted-only. The private self-hosted controller, fixture publication, reference publication, and staged activation remain disabled. Pending fixture descriptors are deliberately rejected by the publication validator.

The opendbc gitlink points to NotAutopilot/opendbc#4.

Verification

• clean uv run --frozen scons -j$(nproc) build
• 91 focused replay, fixture, release-validator, and acados tests passed
• 42 focused harness/release-validator tests passed after static-analysis type fixes
• focused ty check and Ruff passed on every changed Python file
• hosted run 31622612984: required Tesla Pre-AP gate, static analysis, build release, unit tests, macOS build, and process replay (lagd) passed
• hosted card, controlsd, and other shards completed their inventory contracts but remain red against the stale pre-manifest f7644c9 reference baseline
• opendbc safety tests: 90 passed, 8 skipped
• opendbc Tesla Pre-AP tests: 282 passed, 9 subtests passed
• opendbc focused firmware/interface suite: 762 passed, 143 skipped; four timing expectation failures reproduce unchanged on the parent commit