feat: add static production promotion permit verifier - #802

Summary

• add an authority-free JCS promotion input that binds production, the release manifest ref/generation/hash/status (production_candidate or canonical production_released), platform and apps overlay refs/hashes, protected environment, and explicit apps-empty intent
• add a strict offline verifier for the existing ApprovalGrant -> ApprovalGrantConsumption -> ApprovalDispatchAdmission -> LaunchEffectAuthorizationEnvelope chain and DEPLOY_PRODUCTION_ACTIVATE effect
• preflight signed authority without consuming a permit or crossing the dispatch seam, then fail closed on current fence and connector-release drift
• reject duplicate, unknown, nullable, symlinked, mismatched, stale, expired, and wrong-effect inputs
• wire the verifier tests into the repository-native Go gates

Trust and production boundary

--verification-context supplies verification keys, policy constraints, the current fence, and connector-release state. That context is intentionally not self-authenticating: this verifier validates artifacts against the supplied context, while an integration must load it from a base-owned trust source. That source and its provenance are outside this slice and remain a required production gate.

This is a source verifier slice for HELM-473. It creates no signer, approval, connector authority, deployment, or production mutation. Production Alpha remains NO-GO and undeployed until a base-owned trust source, source-owned apply connector, GitOps inputs, and an actual human promotion exist.

Validation

• make quality-pr
• focused go test and go vet for ./core/pkg/promotionpermit and ./core/cmd/promotion-permit-verify
• git diff --check

Checklist

• The change stays within the kernel scope in README.md and docs/KERNEL_SCOPE.md.
• Public docs, SDKs, schemas, or examples are unchanged because this is an internal offline verifier surface.
• Launchpad live local-container conformance is not affected.
• HELM-473 is linked here; no contributor onboarding path changes.
• Release version surfaces are untouched; version-drift passed.
• Security-sensitive material is not included in the PR.
• No public interface is broken.
• No advisory quality warning remains for the changed paths.

Review boundary

Independent authority/security review is required before merge. Leave this PR open after CI; do not merge from this task.