chore(lifecycle): repin the Production lifecycle source to openadapt-ops main

[abrichr]

The validate job in README Production lifecycle fails on unmodified main with:

REFUSED: source file projection changed on openadapt-ops main; repin and rerender

openadapt-ops merged several PRs today, so the bytes pinned by production-lifecycle-source.json moved. --require-current-source refuses a stale pin even when the pin itself is still internally consistent, which is the point of the flag.

What this does

Repins to openadapt-ops 9246994b5d2645aed3fe9bfb25163fdce507a27f and rerenders.

The inventory also changed

A plain repin was not enough. The new projection binds three more canonical files from OpenAdaptAI/.github at 4d2a8265:

• evidence-registry.json
• schemas/evidence-registry.schema.json
• scripts/validate_evidence_registry.py

The canonical validator at that commit imports validate_evidence_registry by bare module name and reads evidence-registry.json beside the policy. It refuses a Production admission whose acceptance evidence is not already bound by digest in that registry.

render_readme_maturity.py holds the canonical inventory as an exact closed set, so it failed with canonical lifecycle file inventory is not exact until the three files were named on this side too. This PR names them. They get fetched and digest checked like every other canonical input, and the comparison stays set equality rather than a subset test, so an inventory that grows again still fails closed.

The bare import needed one more change. _run_canonical_validator materializes the canonical files into a temp directory and loads the validator by file path, which leaves a sibling import unresolvable. The materialized script directory now goes on sys.path for the duration of that call only, and both the path entry and any module imported from it are removed afterward.

The rendered block does not change

I checked the rendered state against the live record before committing, because a README that advertises a state the live record contradicts is worse than a red check.

https://docs.openadapt.ai/production-lifecycle.json is byte identical to the openadapt-ops projection this PR pins: both are 8873 bytes, sha256 7acc2884b5f70bd94521288d07e0567269501d679cf52f1f216cbaf7b81e6a16. The live record still carries all seven targets and every one has latest_admission: null. So the README keeps the positive qualification contract and README.md has no diff here.

Worth flagging separately: openadapt-web's status.json and this record are different documents, and a claim elsewhere that the admission target list is down to one does not match what the live record serves.

Checks

• render_readme_maturity.py --check --require-current-source passes
• tests/test_readme_maturity.py: 9 passed
• ruff check and ruff format --check clean on the modified script

The guard still refuses what it refused before. A tampered pin digest, a rollback to the previous openadapt-ops commit, and a hand-edited README block each exit 1 with the same messages as before this change.

The manifest regeneration is in #1128 so each drift stays separately bisectable.