[chen21019]

Changes

• Bind API Explorer post-build identity checks to the exact release inputs instead of a stale short commit.
• Fail closed for forbidden packages and unresolved linkage; emit line-only runtime-contract diagnostics.
• Activate the official Ubuntu zlib security backport for USN-8954-1. Remove the superseded upstream library which ldconfig otherwise prefers, verify the active symlink, package integrity and SHA256, and align image metadata.
• Retain the existing removed Git DAV/Expat surface after the official package update. Check for surviving native dependencies, and replace obsolete Expat VEX versions with the single current component-absence disposition.
• Remove the now-fixed zlib finding from the vendor-pending set. Keep exact-set security gates and normal required checks.

Verification

• 17 focused API identity, package/linkage and zlib readback regressions, including negative controls and no continuation after failed checks.
• Native isolated Ubuntu/Server fixture: official zlib bytes, active library selection, package verification and MariaDB/libpng/FreeType linkage; no platform data volumes or runtime patch.
• Packaging contract and source checks; normal mandatory CodeQL checks before merge.
• No deployment, production configuration, database or firewall changes in this PR. Published image and QA deployment remain separate gates.