assurance: close reference profile release boundary

[attractor-set]

Summary

• rebuild and enforce the exact repository manifest;
• fix provenance paths and bind the source archive manifest;
• trace all 12 profile requirements and 8 invariants to executable checks;
• make the profile gate build a deterministic source archive and wheel;
• install the wheel and audit documentation/runtime from built artifacts;
• keep canon-lock automation and MANIFEST.json atomic.

Validation

• 34 tests passed;
• 55/55 ASET implementation conformance;
• deterministic replay PASS;
• black-box release audit PASS;
• complete profile gate PASS.