Fix relocation release gates

[andrei-hasna]

Summary

• closes the Repos relocation/remote-identity gate failures blocking Infinity dry-run receipts
• adds bounded release-gate v1 coverage for receipt truth, rollback, non-destructive dry-run, secret-free output, provenance, usability, and pagination
• adds exact package/executable provenance preflight before registry access

Evidence

• exact head: 17f0eea
• release gate manifest: /var/tmp/repos-infinity-release-gate-v1.json (sha256 8950893d8dc2896c87e3cd9e9760f415558a37c1467177abdca9331cc4b3a3ad)
• bounded PASS review: /var/tmp/repos-bounded-receipt-review-17f0eea.json (sha256 ead86df7c8d6d9db63d5be6460c390ea32a185e285f38e9ec9afe765a4a373f2)
• bounded PASS review: /var/tmp/repos-bounded-output-review-17f0eea.json (sha256 677e5d6cbeefe5c5b1b7d0039b01254ea49e14134269aedbb9e46cc84cc87de9)

Local gates

• full suite: 309 tests, 1014 assertions
• typecheck/build: passed
• package: 78 files, sha256 bc860aba39a3085aed9729280e84a0b8702a83bc5a9bc1966928bb490570042d
• gitleaks origin/main..HEAD: no leaks
• git diff --check: passed

No live registry, live DB, install, deploy, or relocation apply was performed.