security(licensing): release production vendor signer

[Coding-Dev-Tools]

Summary

• pin the public key derived from the production Railway signing seed
• set the source-controlled vendor signer release gate to ready
• record the clean-rotation evidence: production inventory had zero issued or active keys, so no compatibility verifier or reissue is required

Verification

• ruff check engraphis/licensing.py tests/test_licensing.py
• python -m pytest tests/test_licensing.py tests/test_commercial_ga.py -q
• focused rerun of the two transient SQLite failures from the larger targeted run passed (2/2)