feat(scanner): add model artifact validation

[duriantaco]

Summary

• add bounded ONNX and GGUF metadata parsers with baseline drift checks
• add pinned real-artifact fixture validation for ONNX/GGUF plus corrupt-artifact checks
• harden policy loading, waiver handling, pickle parsing, diff mode, parquet reads, and related regression coverage

Verification

• python -m pytest -q
• python -m ruff check .
• python -m compileall -q ceres tests scripts
• python scripts/model_fixture_check.py --corpus examples/model-fixture-corpus.yml --workdir /private/tmp/ceres-model-fixture-check --json-out /private/tmp/ceres-model-fixture-check/report-final.json
• python scripts/real_world_check.py examples/clean-ai-repo --separate-scenarios --workdir /private/tmp/ceres-real-world-manual-final --keep-workdir --json-out /private/tmp/ceres-real-world-manual-final/report.json