fix(ci): qualify first release hardening

[f0rr0]

Purpose

Qualification-only transport for the first-release hardening tree. Do not merge this PR.

The transport commit is based on the current displaced main solely so GitHub can exercise the complete PR matrix. Its tree is byte-identical to the signed introduction commit that will be used for the separately approved history repair.

Exact identities

• Signed introduction: a70efaf647b5f62480aa43685bf8434fe3e5bfd3
• Introduction parent: 07a9054faa03d5737dc0193f7a77ed4a71920c05
• Signed qualification transport: 50e15bb7364a48c04e0563484cd009df4e3d3206
• Transport parent / displaced main: 06816d377f96ab8e53d3c6ec8732577cc4386f2e
• Shared tree: c5f95edcb442c8adb5e76585c1825519749da6e5

Local proof

• Aggregate release gate: 936 pass, 10 platform-inapplicable skips, 0 failures across 142 files and 14,010 assertions
• Repository policy graph: 11/11 tasks passed
• Workflow/toolchain proof: actionlint passed; zizmor reported no findings; 50 workflow tests and 10 pinned bootstrap fault suites passed
• Release-control audit: 40 pass, 0 warnings, 0 failures
• Release surface: 18 products, 39 promoted extensions, 6 SDKs, 50 publication-target proofs, 141 GitHub assets
• Focused native, Rust, Kotlin/Android, React Native, JavaScript, Swift, lifecycle, package, archive, formatting, source-input, and binary-contract qualification passed

No history repair or publication is authorized by merging this PR. After exact-SHA hosted qualification succeeds, the protected-main repair remains a separate explicitly approved operation.