Fix #136: thin lesser-body runner and gate template certification

[aron23]

Implements #136 and subissues.

• [Immutable Deploys][M14.1] Refactor provision runner buildspec: make RUN_MODE=lesser-body independent of Lesser #137: Make RUN_MODE=lesser-body a truly thin runner path (no Lesser artifacts / no Go toolchain).
• [Immutable Deploys][M14.2] Skip Node/CDK/pnpm install for RUN_MODE=lesser-body CodeBuild runs #138: Skip Node/CDK/pnpm installs for body-only runs.
• [Immutable Deploys][M14.3] Gate lesser-body template changeset certification (remove per-customer --no-execute-changeset) #139: Gate lesser-body template changeset certification behind BODY_TEMPLATE_CERTIFY (no per-customer --no-execute-changeset).
• [Immutable Deploys][M14.4] Keep managed-release-certification checks valid after runner slimming #140: Keep managed release certification evidence valid after slimming:
  • Add operator-only body_template_certify to update-job create API and plumb to runner env.
  • Update scripts/managed-release-certification to run separate jobs (lesser + body-only + mcp-only) and emit updated evidence bundles/docs.
  • Remove the managed-release-canary GitHub Actions workflow (lab stage validation is sufficient for this flow).
• [Immutable Deploys][M14.5] (Optional) Extend lesser-body release preflight to reject helpers that can’t handle large templates #141: Extend lesser-body preflight for large templates: require helper support for --s3-bucket.

Verification

• bash gov-infra/verifiers/gov-verify-rubric.sh

Fixes #136
Fixes #137
Fixes #138
Fixes #139
Fixes #140
Fixes #141