Fix sealed bridge closure evidence for 0.4.0

[ael-dev3]

Summary

• refresh the Greater Realm production-provenance member digest in the sealed source closure
• raise the installed-toolchain verifier's source-manifest read ceiling from 192 KiB to the canonical 256 KiB closure limit
• add a regression proving a valid closure above 192 KiB is accepted
• propagate the refreshed source-closure and verifier pins to all three protected workflows

Failure boundary

The first B0 run stopped in post-install source/toolchain attestation. Credential loading, deployment, and recovery were all skipped, so no production mutation occurred.

Verification

• canonical source-closure verification: 956 members
• focused workflow and closure tests: 19 passing
• TypeScript typecheck
• sealed-launch preparation verifier
• Greater Realm release-gate verifier
• B0 and prepared policy verifiers
• release projection tests
• git diff check
• two independent no-blocker reviews with recomputed digests and workflow-pin checks