CLI: --version, logging with --quiet/--verbose, ephemeris verification wiring, and --resume (items 15 + 16)

[wiyth00]

Summary

Grouped implementation of work-plan items 15 and 16 (grouped because the --resume guard rides on the same cli.py plumbing), plus the two CLI follow-ups deferred from #12.

Item 15 — CLI ergonomics

• --version prints the package version (from installed distribution metadata, single-sourced per chore: single-source the package version; pin CITATION.cff to it in tests #11), MODEL_VERSION, and the ephemeris kernel name.
• Stage progress messages now go through the logging module: INFO by default, --quiet for warnings/errors only, --verbose for debug. --quiet/--verbose are mutually exclusive. Data outputs (validation JSON, headlines, mode summaries) stay on stdout as plain prints. terminal_summary.txt content is byte-identical.
• Note: the kernel name in --version mirrors load_ephemeris's default literally rather than importing a new constant from ephemeris.py, to avoid conflicting with item 14's upcoming ephemeris.py changes; a test pins the two together.

#12 follow-ups

• --allow-unverified-ephemeris is wired through load_ephemeris(..., allow_unverified=...) in every mode.
• events.json's ephemeris block now records context.kernel_sha256 (verified once at load; no second re-hash of the kernel) and a new "verified" flag from context.kernel_verified.
• Fixed the stale run_manifest.json "command" string, which still referenced run_search.py (deleted in chore: entry-point cleanup — delete run_search.py, prune one-off console scripts #10); it now records the chained-eclipse entry point and whether --resume was used plus which stages were reused.

Item 16 — --resume

• Full mode writes a resume_manifest.json recording model_version, the config file's SHA-256, and the kernel's SHA-256, plus the stage-3 design targets (second-maximum TT JD, latitude, longitude) needed to rebuild downstream inputs.
• With --resume, stages are reused only when their artifacts exist and all three identity values match; any mismatch (different MODEL_VERSION, edited config, different kernel) refuses the resume with an explicit error rather than silently mixing runs.
• Checkpointable stages: 1 (real-Moon enumeration + design screening; RealEclipse rows are reconstructed from real_moon_eclipses.json), 2 (validation report), 3 (optimized design via optimized_system.yaml + design_mode_event.json + manifest targets), and 5 (stability, with the failure guard re-applied to the reloaded result). Stage 4 (fixed-system search) is always recomputed: its ground tracks are not serialized and the figure stage needs them.

Scientific impact

• No change to computed results
• Changes computed results (explain below)

All numerical stages call the same functions with the same arguments; this PR only changes orchestration, logging, and provenance metadata. Reused resume artifacts are byte-identical outputs of a previous identical-identity run. New events.json/run_manifest.json fields are additive.

Checklist

• New behavior covered by tests: parser flags/defaults, --quiet+--verbose rejection, version string contents, a real --version subprocess run, and the pure resume-identity guard (kernel-hash, model-version, and empty-manifest refusals).
• terminal_summary.txt content unchanged.
• CI green — note: CI is the first integrated execution of this change set; I could not run pytest/ruff locally in this environment. Will fix promptly if red.