feat(verify): real beta-channel roundtrip mode; gate beta candidates by macOS base

verify-profiles gains `--profiles beta`: instead of installing from a
local archive it exercises the actual release path (channel resolution,
download, checksum, extract, resource re-index, semantic build) and
adds checks for the recent feature set — WWDC year groups and the year
arg in CLI + MCP, the now-populated --track filter, scope web pages,
hasMore + year facets, hashed overlong paths (+.md), snapshot
provenance meta, and a hard 10 KiB assert on the MCP definitions.
First run: 44/44 green against snapshot-20260610-beta.1.

Channel comparator refined to the agreed policy: on the beta channel
EVERY candidate — prerelease or stable — must be built on at least the
installed corpus's macOS base, so a later beta from an older OS can no
longer displace the install either. First install (no local provenance)
takes the newest outright.