Add CI validation helpers with explicit signature selection and owned results

docs/ci-validate-file-object.md

@@ -197,8 +197,11 @@ statuses and signing time. Do not interpret status success alone as selection
 of the company certificate. First successful does not necessarily mean first
 listed: CI may reject the primary and continue.
 
-`0x80` has additional policy and fallback effects. It has not been published as
-a supported Domito constant or a production default. The companion research
+`0x80` has additional policy and fallback effects. Domito exposes it only as
+`DOMITO_CI_VALIDATE_FLAG_FIRST_SUCCESS_EXPERIMENTAL` and through the opt-in
+`DomitoCiSignatureSelectionFirstSuccessfulExperimental` mode in
+`DomitoValidateFileObjectEx`. It is not a production default or a stable signer
+index. See the [validation helper contracts](ci-validation-helpers.md). The companion research
 `SIGNATURE-SELECTION.md` provides the full static evidence and an alternative
 primary-signature path using `CiCheckSignedFile`.