fix: pin Phase 6 forge policy revision

[acedward]

Summary

• require live candidate issuers to descend from the audited Phase 1 remediation and exact Phase 6 policy revision d8db4327958bc057db685714d116579a00947317
• pin the current Phase 6 build-set schema and validator bytes
• preserve the DDD integration fixture only in an explicit nonauthorizing test lane
• keep promotion-envelope-v1 wire/role compatibility unchanged

Breaking change

This intentionally rejects live candidates that do not descend from the Phase 6 policy revision, even if they descend from the older Phase 1 minimum. The legacy lane remains test-only and cannot authorize publication.

Verification

• exact nonauthorizing legacy fixture: PASS in Docker
• live Phase 6 revision ancestry plus exact current blob pins: PASS in Docker
• full 43-test run exercised all code; two failures were environment-only because the first minimal image lacked jq, and both affected tests passed when rerun with jq
• independent cross-repo supply-chain audit: pending; do not merge before PASS/0

No release or catalog mutation is performed by this PR.