fix(firewall): omit Package binding and accept mixed-profile enforcement

Omit only -Package Any when constructing the bootstrap rule pair and require
its measured empty Package readback. Keep the existing profiles, remote
scopes, ownership boundary, and query budgets.

Require raw PrimaryStatus OK, enforcement code 1 present, and code 20
absent. Preserve typed transport faults and distinguish post-write refusal.
Add the S2 render regression and the three ruled enforcement cases; correct
the composite fixture provenance, diagnosis, ADR, and v0.70.0 changelog.

Refs BigscreenVR/spt-bs-releases#297
Co-authored by: todlando