M7 Incrementals, Exclusions, and Empty-Source Safety Evidence

Coverage: ordered normalized exclusion rules, exclusion policy persisted in signed manifests, incremental compatible-baseline selection, independently restorable complete manifests, parent linkage, content-addressed blob reuse, and empty-source opt-in.
Verification: M7 unit, incremental, and empty-source suites are included in the passing project verification.
Full verification: make check passed with 78 unit/contract, 39 integration, 7 fault, and 17 security tests, plus Ruff, mypy, frontend typecheck, and frontend production build.
Scope: scheduling remains M8 work.