fix(galadriel): bind reciprocal producer evidence

[sepahead]

Summary

• require an operator-provisioned, key-safe Galadriel process epoch and document deployment-owned uniqueness/non-reuse
• enforce global immutable content identifiers and projection algorithm version/digest identities in the deployment registry
• freeze the byte-identical Galadriel registry fixture (3,053 raw bytes; canonical SHA-256 7644ec2bbf0e400303aaad62c647eea36bd919913f1a28a81c52c13e00dd45ba)
• pin the reciprocal baseline to Galadriel PR perf: splat performance mode (key 'p') + perf-smoke regression guard #21's landed main commit 81437d807ca83b66b45c8353968948e540072d97, with all eight inventoried blobs recomputed from that commit
• refresh moved Haldir and pid-rs remote-main identities and Haldir's changed lockfile digest without expanding component evidence into deployment claims
• repair two strict plant-test Clippy failures inherited from current main using an observed copied-row mutation and checked Duration subtraction

Evidence boundary

This closes the component-level epoch/golden/revision-pin task. It does not establish real-router mTLS/ACL enforcement, production certificate custody, principal binding, receiver delivery/retention, heartbeat/loss/restart behavior on the target topology, calibration, scientific acceptance, or release readiness.

Validation

• bun install --frozen-lockfile
• git diff --check
• bun run check:phase0-baseline — 133 surfaces, 17 hazards, 155 production files, 31 configurations; 114 fail-closed fixtures
• bun run check:ncp-coherence
• bun run validate:all — pass at 113ee70d5660daf90bb373bd7857d4b3f2f56784
  • 305 frontend tests
  • 231 plant boundary mutations rejected
  • default Rust: 307 passed, 1 ignored, plus 22 example tests
  • NCP Rust: 405 passed, 1 ignored, plus 22 example tests
  • default/NCP/plant Clippy with warnings denied
• scripts/check-version-coherence.sh
• bun run check:bundle — 432.3 / 700.0 kB initial gzip budget
• bun run test:coverage — 305/305 tests
• cargo check --locked --manifest-path src-tauri/Cargo.toml --features cuda,tensorrt
• cargo check --locked --manifest-path src-tauri/Cargo.toml --no-default-features
• direct remote-main and commit-object hash audit for NCP, Haldir, Galadriel, and pid-rs; shared fixture verified byte-identical