Bind final Workshop candidate

[kcsfelty]

Summary

• bind Workshop 0.5.0 from protected main 66c923f9505359ee7ae92ca48beddd044d2bb036
• regenerate the assembly dependency lock from an empty directory and fresh npm cache so the same-version tarball cannot retain stale integrity
• refresh the component example and LF-canonical local-build attestation
• preserve the cold restore dry-run reliability correction already on protected main

Exact Workshop handoff

• tree: fa55f0c8bce7a77945626f177a7759e903d7f59b
• bytes: 274551
• SHA-256: 5b266e029201e0eba33d497212b9f80c4b6821731efe289189d547c626f8d44c
• integrity: sha512-4DwTKaR/cObyGvNEUmQ0a7VzRU4oA2Ma5fO4IM2on+B8LOst0bAdeSLZvYqHl7rDblfgZyOG0OFBtlM9AKcnGw==

Verification

• fresh-LF npm run check (34 tests; typecheck/build; inventory/example/secret/SBOM/OIDC/legacy fixture; full and production audits; pack)
• fresh-LF npm run test:packed
• fresh-LF npm run test:compose
• full modern Docker qualification: exact pinned graph, repair/mixed lifecycle, three cold restore dry-runs, tamper rejection, valid restore, immutable post-restore dry-run, protected semantic configuration, SQLite, Qdrant, and unreachable profile
• full packed two-process legacy adoption
• zero protected credential volumes and zero Seedbed operator containers

No package publication, tag, GitHub release, or image publication is included.