Rederive qualification at release time

[vriesd]

Summary

• make sealed qualification bundles the only production release authority
• reopen and rescan every object and artifact, regrade all attempts, and rederive canary, provenance, usage, policy, analyzer, manifest, and decision
• require current release source to match the bundled source closure, one fresh campaign ordered before the canary, and exactly one clean matching bundle
• reject digest-only records, forged decisions, missing sources, contradictory roles/manifests, stale campaigns, corrupted siblings, archive secrets, and oversized manifests

Verification

• bun run check: 598 passed, 1 intentional skip
• bun run replay: 13 of 13 cassettes reproduced
• pinned OpenCode 1.18.6 live smoke: passed
• real canonical 76-cell CLI bundle regrades to VERIFIED
• adversarial reseals for forged decision, missing source, contradictory plan/manifest, stale campaign, and corrupted sibling are rejected
• multi-model interrogate and comment/deslop review: green
• contribution commit and push preflight: passed