Refresh production runtime pins before Greater Realm C0

[ael-dev3]

Summary

• refresh the fail-closed production bootstrap and launch-envelope pins to the current OpenAI-signed ChatGPT Node v24.19.0 and bundled npm 11.17.0
• keep the immutable publish-proof Node trust pin aligned and refreeze the protected 384-member deployment closure
• harden the exact CLOSE RECORD focus assertion after exact-main CI exposed its passive-effect timing race

Verification

• 86 focused tests passed across realm focus, castle panel, bootstrap, and closure boundaries
• RealmMapScreen full file: 25/25 passed; post-fix stress: 28/28 passed
• typecheck and production build passed
• npm audit: 0 vulnerabilities
• protected closure: 384 members verified; all three workflow pins match manifest SHA e545d6a528d3c548734ba0b0057bfe9995bc9b74a330b277a6137d8eb7caad22
• independent code and security reviews: no findings

This remains pre-C0: it does not activate B0, change the public release version, mutate production, or merge PR #193.