Pin canonical Ledger proof-data identity

[acedward]

Phase 3p remediation companion for acedward/midnight-binary-forge#8.

• pins the canonical file-only, path-sorted Ledger-static-9 semantic member manifest
• keeps deterministic ZIP layout and outer archive identity separate
• makes catalog validation fail closed on the reviewed semantic contract
• adds cross-repository golden coverage for the semantic digest and deterministic archive

Verification:

• scoped Docker catalog/full suite: 43/43 passed
• actionlint 1.7.12, Python compile, JSON parse, and git diff check passed
• exact-head hosted Warehouse CI run 33169376503 passed all four jobs
• paired forge exact-head policy 33170546619, Compact 33170546586, and full Q8B/native/stock-K19 33170546601 all passed

No release asset, body, or settings were changed. Do not merge until a fresh independent audit of this PR and acedward/midnight-binary-forge#8 passes.