feat(release): qualify immutable mc-host inputs

[ahrav]

Summary

• qualify exact production model, runtime, harness, and credential inputs
• generate immutable input locks and closure catalogs
• keep production qualification fail-closed

Stack

PR 2 of 10. Base: stack/mc-host-01-core-contract.

Validation

• production-input qualification tests
• deterministic regeneration and drift checks

Post-Deploy Monitoring & Validation

No runtime behavior changes. During release qualification, monitor input-lock drift and failed artifact/license checks; do not promote if any digest or qualification gate diverges. Owner: release maintainers.

Summary by CodeRabbit

• New Features

  • Added release qualification records covering production inputs, supported runtimes, credentials, platform requirements, and artifact integrity.
  • Added qualification fixtures and evidence for model, tokenizer, corpus, and configuration assets.

• Bug Fixes

  • Strengthened validation for unsafe sources, credential exposure, unsupported capabilities, malformed metadata, and invalid release inputs.
  • Improved platform compatibility and predecessor-release checks.

• Tests

  • Added comprehensive release-contract, artifact-integrity, security, credential-mapping, and qualification-drift checks.
  • Integrated release qualification checks into continuous validation.