Integrate local commitments and governed Node journey image admission

[echoomegaprime]

Local certification intake dropped declared artifact/source commitments, and the existing P4 sealer could not prepare a separate Node24/Python3.11 journey image. This stack preserves PR28's measured runtime identity, retains the declared commitments through acquisition, and adds bounded image preparation and sealing through the existing authority.

Preparation binds the recipe, source, dependency commitment, SPDX, provenance and observed qualification receipts. Sealing requires the independently reviewed request digest, current unchanged owner policy and attestation, the same trusted signing authority, a bounded lifetime and descriptor-bound existing-key custody. Policy or revocation drift fails before signing. The resulting image policy is separate from the twelve existing P4 role images.

The P7 acceptance generator now declares the manifest and exact journey that its worker executes. Previously its default environment measurement described a different policy and omitted the journey, causing seven scenarios to fail before reaching their intended execution checks. A new isolated whole-generator regression verifies the positive path, suspension, lease fencing and retained NOT_READY release boundary.

Validation at 77cba79e0fd971ad7301203242108c76998d26e5: 752 tests passed, one platform-specific skip, P1 acceptance passed, and fresh build preflight has 29 required passes. Independent reviewers accepted the admission/custody implementation and the P7 fixture correction. The new P7 regression failed on the preceding fixture and passes after correction. Hosted CI and the exact-source App verdict remain independently recorded checks.

This PR is stacked on agent/certforge-runtime-identity-live-20261009 at 5f1f4cdf0fcb254febc8b2cd91051ed256f9d63b, preserving that owner's PR and the deployed d8ad9fd lineage. The separately qualified image retains its actual build source 9c9a0817b4cda736b9d7cdb0ca564b9e0c42e27a and immutable digest sha256:ed26a5f6953fed5af99a21e149085873f75be67d01105d685ea5a7e69cc612b5. Two observed no-cache builds match after normalized filesystem/config comparison. The existing scan policy passes with zero critical, fixed-high or secret findings; 166 total findings include 44 unfixed high findings.

Deployment remains held. The scoped SDK rejected the existing deployment-lock executable before signing, so the prepared request remains unsigned; no alternative interpreter was used to evade that rejection. The exact-source App certificate is signed NOT_READY because production E2E attestation is absent. Local tests and image qualification do not establish image admission, source release certification, deployment or a 95+ bot grade.