Sanitize public bundle provenance

[sftimeless]

Summary

• replace private repository and SHA provenance with a public release version plus an immutable product-file digest
• reduce public_surface.json to a strict positive allowlist
• remove the private source path from fields.md while retaining all customer-facing limitations
• update the release checker and checksums to enforce the sanitized boundary

Validation

• release bundle checker: PASS (37 allowlisted files)
• execute contract checker: PASS
• keel-policy tests: 10 passed
• keel-setup tests: 58 passed
• shared tests: 15 passed
• private/public product-file comparison: PASS
• targeted private-vocabulary scan: zero hits
• git diff --check: PASS

History and release boundary

This is a forward-only remediation. It does not rewrite public history, merge, deploy, certify, touch production, or publish a separate release.