Add environment evidence and contamination checks

[morluto]

Record environment evidence and verify contamination checks after test runs.

Part of #69.

Acceptance:

• Declared permission/keychain/quarantine states reproduce.
• Rollback removes credentials/files/processes.