IR-625: decode state-clause Kani playback for native replay

[kreneskyp]

A falsified postcondition harness previously reached state-clause replay only through a test-only playback parser. StateClauseReplayInputs::decode_falsification now validates the selected clause, operation scope, persisted field order, generator-decoded predicate, harness path, and failed assertion before decoding values through the shared witness decoder. It performs checked integer conversion and passes named pre-state values to the existing replay builder; the caller still supplies native post-state and obligation_identity.

The production decoder accepts the installed Kani playback's split assertion line and rejects wrong clauses or harnesses, cover evidence, malformed playback, repeated fields, arity or width faults, out-of-domain values, and forged predicate details. The real-Kani integration case exercises the production path and checks both violating and respecting native replay.

Independent code, gap, and spec reviews (SR-7740..7742) found no remaining issue after the parser refinement; their validated records are included. On clean head ac3d8ededbdc91120f949b2a5c58dc25deab753a, pre-PR make ci passed both MSRV and default Rust lanes (222 library, 444 integration, 27 ignored Kani-lane tests, and one doctest per lane), plus format, spec, lint, deny, audit, and unsafe checks. The separate make kani-gate passed all 27 expected real-Kani cases (Kani 0.68.0, clean tree), including the new state-clause playback case. Terra independently repeated that focused case on this exact public head: 1 passed, 470 filtered, exit 0, no CG source change.

FR-024's Q-1 obligation identity and QSL FieldSite.domain key divergence remain separate open questions. This PR adds no compatibility reader, copied schema, or dependency pin.

Pre-merge validation on the same clean head: a second make ci passed both MSRV and default lanes (222 library, 444 integration with 27 real-Kani tests ignored, one doctest in each lane) and the full format/spec/lint/deny/audit/unsafe checks. A second make kani-gate passed all 27 expected real-Kani cases with a clean tree (/tmp/ir625-premerge-kani-gate-ac3d8ed.log). The Kani freshness check reports fresh against CG main after the unrelated IR-598 spec merge. No source commit or dependency update occurred between these gates.