Harden notification bridge prepared deployment

[ael-dev3]

Summary

• bind the prepared successor to the immutable live B0 predecessor while preserving the successor source identity
• require strict per-binding predecessor version pins and re-attest immediately before upload
• fail closed with bounded, redacted provider rejection diagnostics, including raw canary-echo suppression
• refreeze the complete deployment closure and protected workflow pins

Verification

• complete Vitest inventory (eight deterministic shards; long workflow cases run in bounded groups)
• root typecheck and all three production build variants
• sealed-launch preparation, licensing, asset, boundary, file-size, and bridge policy gates
• 956-member prepared deployment closure
• auth-bridge typechecks, 365 tests, and dependency audits
• independent atomic-deploy, Cloudflare-contract, and privacy reviews: no blocker

No production mutation is performed by this PR.