feat: publish lesser-body certification contracts and evidence

[aron23]

Summary

• publish a canonical lesser-body consumer contract and machine-readable compatibility boundary in lesser-host
• make body-enabled managed certification explicit, including body version selection, compatibility validation, dedicated body evidence files, and committed example evidence bundles
• drive Project 17 readiness from the canonical lesser-body certification evidence and update the canary workflow defaults to the current M10-M12 parent issues

Commits

• 6a88db0 docs: publish lesser-body release contract
• 1c06838 feat: define lesser-body compatibility contract
• 821d224 feat: certify lesser-body releases explicitly
• a8008f4 feat: persist lesser-body certification evidence
• f4cfcd7 feat: sync readiness from lesser-body evidence

Closes

• Closes [Immutable Deploys][M12] Publish a canonical lesser-body consumer contract and certification evidence #110
• Closes [Immutable Deploys][M12.1] Publish a dedicated lesser-body consumer release contract in lesser-host #116
• Closes [Immutable Deploys][M12.2] Define a machine-readable lesser-body managed compatibility contract #117
• Closes [Immutable Deploys][M12.3] Make lesser-body release verification a first-class managed certification check #118
• Closes [Immutable Deploys][M12.4] Persist canonical managed-release evidence bundles for body-enabled runs #119
• Closes [Immutable Deploys][M12.5] Sync Project 17 readiness from actual lesser-body certification evidence #120

Verification

• GOTOOLCHAIN=auto go test ./internal/provisionworker ./scripts/managed-release-certification ./scripts/managed-release-readiness -count=1
• GOTOOLCHAIN=auto go test ./scripts/managed-release-readiness -count=1
• bash gov-infra/verifiers/gov-verify-rubric.sh