feat(misp_lab): bind Nacre world metadata

[pparage]

Summary

• add optional scenarios/misp_lab/manifest/world.json
• pin the Nacre galaxy/collection identifiers, cluster commit and SHA-256 used by catalog PR feat(exercise-world): package Nacre and seed MISP range42-catalog#211
• bind both existing MISP sample-event UUIDs to their canonical Nacre country, victim-company and threat-actor UUID/value pairs
• document that the manifest is narrative metadata and does not affect deployment
• add a focused automated contract test

Infrastructure impact

None. scenario_vms.json, _reserved.json, inventory, VMIDs, IPs, feature flags and Ansible playbooks are unchanged.

Validation

• PYTHONDONTWRITEBYTECODE=1 python3 tests/test_misp_lab_world_manifest.py -v
• jq empty scenarios/misp_lab/manifest/world.json
• cross-repository UUID/value comparison against catalog PR #211's vendored cluster
• git diff --check
• confirmed no diff from origin/dev for scenario_vms.json or _reserved.json

./scenarios/_check_reserved.sh still reports pre-existing dev collisions for VMID/IP 1186 and 1187. This PR does not touch those manifests or reservations.

Refs #150
Related: range42/project_management#106
Depends on: range42/range42-catalog#211