[AZ-329] [AZ-330] [AZ-523] [AZ-524] Batch 44 atomic refactor

Implements two new C12 services and rebalances the C11/C12 boundary
in one atomic commit:

* AZ-329 PostLandingUploadOrchestrator — gates C11 upload on the
  `flight_footer` FDR record's `clean_shutdown` field; 4 refusal
  modes; new FdrFooterReader Protocol + LocalFdrFooterReader.
* AZ-330 OperatorReLocService — AC-3.4 visual-loss re-localization
  hint; reuses shared LatLonAlt; OperatorCommandTransport Protocol
  cut (E-C8 owns the future pymavlink concrete); new FDR record
  kind `c12.reloc.requested`; log redaction (lat/lon 5 decimals,
  reason 200 chars).
* AZ-523 C11 internal flight-state gate removed (SRP refactor):
  `confirm_flight_state` / `FlightStateSignal` use /
  `FlightStateNotOnGroundError` deleted from C11; TileUploader
  contract bumped to v2.0.0 (frozen) with migration note; AZ-317
  superseded.
* AZ-524 Package rename `c12_operator_tooling` →
  `c12_operator_orchestrator` across source, tests, pyproject,
  CMake, Dockerfile, compose, CI, runtime-root services class
  (`OperatorOrchestratorServices`) + factory function
  (`build_operator_orchestrator`), logger namespaces, config slug,
  docs, and the E-C12 epic title.

Tests: 1543 passed, 80 skipped (all environment gates). Targeted
AC suite (AZ-329 + AZ-330 + FdrFooterReader): 37 passed. Cold-start
NFR-perf still ≤ 500 ms p99.

Tracker: AZ-317 → Done (superseded); AZ-319 v2.0.0 contract bump
comment; AZ-329/AZ-330 → In Testing; AZ-253 epic renamed; AZ-523
+ AZ-524 created and closed as audit-trail tickets.

See `_docs/03_implementation/batch_44_cycle1_report.md`.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/gps_denied_onboard/components/c10_provisioning/__init__.py

@@ -5,7 +5,7 @@ lives at the L1 ``_types`` layer so C10 can re-export it without
 crossing the components.* boundary (architecture rule AC-6).
 
 The AZ-321 ``EngineCompiler`` plus its DTOs are re-exported here so
-the composition root and downstream operator-tooling code consume
+the composition root and downstream operator-orchestrator code consume
 them through this single contract surface.
 """
 

src/gps_denied_onboard/components/c10_provisioning/manifest_verifier.py

@@ -9,7 +9,7 @@ a verify failure — callers branch on ``outcome`` (per the contract at
 
 The Protocol + DTOs live alongside the implementation here; the
 public re-export surface lives in ``c10_provisioning/__init__.py``.
-Cross-component consumers (C5 takeoff arming, C12 operator tooling)
+Cross-component consumers (C5 takeoff arming, C12 operator orchestrator)
 will import via a future ``_types/manifest_verify.py`` shim if and
 when they wire up — the AZ-270 lint forbids direct
 ``components.c10_provisioning`` imports from other components.