feat(lethe): qualify cellular anomaly collection without hardware-coupled acceptance

[forkwright]

Problem

Phase 08 intends to use cellular-network anomaly observations in OPSEC posture,
but Akroasis has no named collector/analysis owner or acceptance boundary for
that input. Leaving it as a generic "separately qualified collector" makes the
software path, device path, privacy boundary, and phase-close gate ambiguous.

Ownership boundary

• lethe owns the cellular domain adapter: versioned input normalization,
  anomaly analysis, provenance/freshness, privacy classification, and typed
  signal emission.
• The application-wide collector lifecycle remains feat(runtime): supervise configured collectors through one bounded lifecycle #400; the adapter does not
  create another supervisor/status registry.
• The application-wide external-connection inventory and truthful offline
  posture remain feat(runtime): prove a truthful application-wide offline connection state #407; the adapter registers bounded refuse/cancel/status
  hooks rather than creating another offline controller.
• Canonical signal sensitivity/minimized evidence remains security(signals): enforce typed sensitivity and minimized evidence at the canonical pipeline #406; lethe maps
  cellular fields into that contract rather than defining a second envelope.
• Concrete modem/device inventory and assignments remain instance canon, not
  product planning.

Done when

• A deterministic replay/mock backend exercises the complete software path
  without hardware and emits source-attributed, observation-time/freshness-
  carrying cellular anomaly signals with explicit unsupported,
  unavailable, stale, and unknown states; it never fabricates a healthy
  or zero observation.
• Malformed, truncated, oversized, replayed, and schema/version-unknown
  inputs stay within declared byte/work/memory/cardinality bounds, fail
  explicitly, and emit no accepted signal from invalid or unattributed input.
• The adapter participates in feat(runtime): supervise configured collectors through one bounded lifecycle #400 qualification/start/stop/reconfigure and
  status, and registers feat(runtime): prove a truthful application-wide offline connection state #407 refuse/cancel/status hooks; offline refuses new
  opens, settles active paths within a bound, and reports incomplete rather
  than claiming offline when a hook fails.
• Cellular identifiers and raw observations are classified and minimized
  through security(signals): enforce typed sensitivity and minimized evidence at the canonical pipeline #406. Protected payloads remain under lethe access/retention/export
  policy, and unauthorized or unclassified export fails closed.
• An operator-scheduled device-qualification stage later proves the above
  lifecycle on each explicitly supported modem/device backend. No hardware
  proof is inferred from replay, and no model/count/location is embedded in
  product planning.

Closure split

Replay/mock software implementation may proceed independently. Phase 08 can
claim cellular software-path acceptance after the first four clauses, but its
cellular capability cannot be called production/device-qualified—and the
phase's device-qualification stage cannot close—until the final,
operator-scheduled clause is met.

No hardware action is authorized by this issue.