[DGX Spark] Add protected single/dual Express qualification and activation evidence

## Summary

Create protected physical DGX Spark Express qualification and activation evidence for single-Spark defaults/secondary profiles and the Experimental automatic dual-Spark profile.

Parent Epic: #8379

## Matrix

### Single Spark

- Current Qwen automatic default.
- Public Lightning NVFP4 explicit-only profile.
- Clean install, cached install, same-revision rerun, resume, recovery, profile switch, uninstall, and baseline restoration.

### Dual Spark

- Automatic qualified two-Spark DeepSeek V4 Flash profile from PR #8129.
- No-peer single-Spark fallback before distributed downloads.
- Explicit and legacy inference intent remains authoritative.
- Pretrusted SSH, direct CX-7 topology, ranked node identity, authenticated serving, rollback, receipt ownership, recovery, and exact uninstall.

### Functional and safety evidence

- Direct API chat and tool calls.
- OpenClaw chat and unhinted create/read-file task.
- Long-context workload, concurrency, cold/cached startup, and soak.
- Host memory, KV/cache/graph planning, throughput/latency, and kernel/NVIDIA events.
- OpenShell coexistence, route ownership, resume, failed-start cleanup, and prior-service restoration.

## Acceptance criteria

- [ ] Every run binds host/OS/driver, NemoClaw, OpenShell, model revision, image digest, recipe/preset/topology digests, and exact serving command.
- [ ] The Qwen single-Spark default passes without explicit profile intent.
- [ ] Lightning passes only through its explicit profile and does not change defaults.
- [ ] Automatic dual-Spark selection occurs only after exact topology qualification.
- [ ] Ordinary dual no-match falls back before image/model download; explicit incompatible intent fails before effects.
- [ ] Kernel `NVRM`, `Xid`, `GSP`, `UVM`, `NV_ERR`, OOM, parser, route, and tool-call failures are retained and fail the applicable gate.
- [ ] Failed startup and interrupted onboarding leave bounded resumable state or restore the previous healthy baseline.
- [ ] Receipt-owned recovery and uninstall remove only the selected runtime.
- [ ] Single Spark retains its documented support status.
- [ ] Dual Spark remains Experimental until two-system physical evidence and CI ownership are accepted.
- [ ] Platform-matrix changes are generated only from accepted evidence.

## Related

- Epic #8379
- PR #8129
- #8246 / PR #8249
- #7127

Signed-off-by: Prekshi Vyas