feat(simulation): qualify S0 time and resource gates

docs/runbooks/SIM_S0_AI_WORKER.md

@@ -36,7 +36,7 @@ Copy the reviewed script to the D-only worker source root, then invoke it as
 root inside `MissionCore-Sim` with a unique immutable run ID:
 
 ```bash
-simulation/s0/worker-smoke.sh <UTC-run-id>-stock-rover
+simulation/s0/worker-smoke.sh <UTC-run-id>-stock-rover <1|2>
 ```
 
 The script:
@@ -44,11 +44,15 @@ The script:
 - creates a new network namespace containing only loopback;
 - starts Micro XRCE-DDS Agent, PX4 SITL and the stock Gazebo Ackermann world;
 - verifies the DDS session, `/fmu/out/vehicle_status_v1` and Gazebo `/clock`;
-- records listeners and a non-acceptance resource point sample;
+- proves pause freeze and exactly one 2 ms physics step;
+- measures the declared 1× or 2× real-time factor over four seconds;
+- samples owned CPU/RSS, available RAM, swap, D free space and global co-tenant
+  GPU load at 500 ms intervals;
+- records Gazebo service/topic inventory and runtime listeners;
 - sends the PX4 `shutdown` command and rejects owned-process residue.
 
-Do not reuse a run ID. A failed run remains diagnostic evidence; rerun with a
-new ID after correction.
+Run both factors as separate immutable cases. Do not reuse a run ID. A failed
+run remains diagnostic evidence; rerun with a new ID after correction.
 
 ## Required target inventory
 
@@ -119,6 +123,25 @@ The manifest must contain exactly all IDs from `required_evidence`. Artifact
 paths are relative, confined regular files. The doctor rejects missing,
 additional, changed or cross-generation evidence.
 
+Build the redacted manifest only from two passing runs made with the exact
+accepted profile generation:
+
+```bash
+python3 simulation/s0/build_evidence_manifest.py \
+  --profile /mnt/d/NDC_MISSIONCORE/simulation/source/qualification-profile.yaml \
+  --run-1x /mnt/d/NDC_MISSIONCORE/simulation/artifacts/s0/<accepted-1x-run> \
+  --run-2x /mnt/d/NDC_MISSIONCORE/simulation/artifacts/s0/<accepted-2x-run> \
+  --output-dir /mnt/d/NDC_MISSIONCORE/simulation/artifacts/s0/evidence/<generation> \
+  --d-root /mnt/d/NDC_MISSIONCORE \
+  --source-root /mnt/d/NDC_MISSIONCORE/simulation/source \
+  --repository-commit <full-commit-sha> \
+  --wsl-windows-path 'D:\NDC_MISSIONCORE\simulation\wsl\MissionCore-Sim'
+```
+
+The generator refuses an existing output directory, non-passing runs,
+candidate pins, commit drift, incomplete Nav2/ROS discovery or any input/output
+outside the reviewed D root.
+
 Validate without writing:
 
 ```bash