fix(hf): harden terminal Kernel readiness fallback

[Lutar, Stephen P. (stephenlutar2-hash)]

Outcome

Repairs the downstream HF Release Readiness terminal after finalizer publication succeeded but the terminal hit the same empty Kernel metadata SDK error.

Change

• exact authenticated Git revision fallback only for the observed empty-metadata error;
• exact-revision materialization only for the matching loader error;
• provenance labels for metadata and selfcheck transports;
• unrelated exceptions remain fail-closed;
• no permission, workflow-order, asset, visibility, or policy changes.

Evidence boundary

Protected PR verification is authoritative. Live readiness and issue #257 are not green until this merges and the terminal workflow succeeds.

[Lutar, Stephen P. (stephenlutar2-hash)]

Superseded by signed, current-main-compatible PR #356, which includes the terminal readiness repair and is already on the protected auto-merge path. This unsigned draft is closed without merge.