Adds archive-checkout image workflow evidence and k3s pull verification; tiers 0-2 satisfied before state-hub cutover.