Bind consolidated Waystone provenance

[kcsfelty]

Summary

• replace the obsolete Waystone 0.3.0 runtime archive with protected-main commit 0c40be9753f2e4fd1b89b203c3aedf7742c23912
• vendor the exact owner candidate, inventory, and CycloneDX evidence for offline verification
• add a Seedbed provenance record that binds the source tree, archive SHA-256/SHA-512/size, unchanged asset manifest/CSS, and exact Workshop/schema/catalog compatibility
• include every Waystone evidence digest in the rendered graph, deterministic bundle, complete Seedbed SBOM, and candidate handoff
• document the consolidated Waystone boundary and refresh the LF-canonical assembly attestation

Exact Waystone handoff

• source tree: 413e01179ee719c979485b68f32705c10794675c
• package bytes: 110720
• package SHA-256: 54baccbca7dcba03a3a6ea7d2c3bfa039d3c83a5513de496569fb4418245d7f9
• package integrity: sha512-RNxn1Paeor0oDKxpux0hRYAUCJ6UiQXcAcMKcq6HrubLHaqBl+9HOtcb/6NKfmCnnLGB7rCeTKmVjObetSopvQ==
• owner candidate: ebf28efe18829b35963d83868a661b602e384322a29a44f539944a98fe02c3c7
• owner inventory: 6bc1fe2c0e0954fed0d012da09c04f1e3f3d271344c1d6e29c3d08fde1bef3f6
• owner SBOM: e74836af594c9dc407b3250e89b53aafc151e0f59b5621796cbfd4188aa3d279
• unchanged manifest/CSS: f341c3fe... / 6439decf...

Verification

• fresh-LF npm run check (34 tests; typecheck/build; inventory/example/secret; 12-component/13-dependency complete SBOM; OIDC; legacy fixture; audits; pack)
• fresh-LF packed consumer and Compose graph
• full modern Docker graph, mixed lifecycle, cold backup/restore/tamper, protected semantic configuration, SQLite, Qdrant, and unreachable profile
• full packed two-process legacy adoption
• two independent package repacks with identical SHA-256
• zero tracked obsolete Waystone coordinates, protected credential volumes, and Seedbed operator containers

No npm publication, tag, GitHub release, container image build, or image publication is included.