ci: anchor demo freshness to shared main

[fengjikui]

Summary

• anchor demo freshness checks to a commit that is reachable from shared main
• preserve each chapter's original capture commit separately for provenance
• document and test the behavior so squash merges no longer break governance

Why

PR #22 passed its three-platform matrix, but the exact merge-commit integrity job could not resolve capture commits that existed only on the pre-squash branch. The shared checkpoint is the tree-identical, validated merge commit from PR #22; original capture SHAs remain recorded and are not rewritten.

Validation

Validated commit: ad9022d5246d186fa46916798d0dc112e53e61f6

• node scripts/demo-freshness-audit.mjs --target HEAD --strict
• node scripts/documentation-consistency-audit.mjs
• npm run smoke:governance
• git diff --check
• isolated single-branch clone with capture-only commits intentionally unreachable: strict freshness and governance passed
• npm install && npm run release:check:macos — passed on macOS arm64, Node v24.14.0 (131.0s)

Risk

Release-governance behavior only; no product runtime, capture schema, package contents, or Viewer behavior changes.