fix(release): bootstrap cold candidate dependencies

[ZSeanYves]

Summary

• make the Phase 11 gate populate exact registry dependency sources before auditing them
• preserve frozen release builds after the dependency integrity check
• fix release-candidate validation on a clean GitHub-hosted runner

Regression evidence

• reproduced candidate run 31672990008 failure: missing moonbitlang/async source after moon update
• passed a detached cold worktree test starting without .mooncakes
• passed tools/check_phase11.sh
• commit hook full gate: 303 Native tests and 298 wasm1 tests
• moon info and moon fmt produced no interface changes

Publication boundary

This PR does not publish packages, create releases, or create/push tags.