fix(control-plane): remove duplicate lease digest import

[Duang777]

Goal and outcome

#5381 merged after #5377 and re-added the same BARE_SHA256_PATTERN import in task_lease_workspace.ts. The duplicate declaration makes control-plane typecheck and every test importing the module fail before execution.

This removes only the second import. The canonical matcher use and the consumer manifest added by #5377 remain unchanged.

Validation

• npm run typecheck:control-plane
• node --no-warnings --experimental-sqlite --experimental-strip-types --test tests/control_plane_ts/content_digest_single_owner.test.ts (17 passed)
• git diff --check origin/main...HEAD

No workflow, schema, runtime behavior, or dependency changes.

[Duang777]

Exact-head update for 9d993f784b3fb73fb81e659b384a133dc6a3fe3d:

• Merged current main@b3879f96f with a signed-off merge commit; the PR diff remains one deletion in task_lease_workspace.ts.
• npm run typecheck:control-plane passes.
• tests/control_plane_ts/content_digest_single_owner.test.ts passes: 17/17.
• The candidate-side CLI budget checks pass before the differential starts.
• A full CLI base/head differential against the last runnable pre-regression main, ae9aca72d09a98cbced51fafe1d4a81368c9c8e8, passes with 102/102 rows, 0 candidate-only rows, and 0 review-required rows.

The prior kernel-static-checks failure is a base-side bootstrap deadlock, not a candidate failure. Its file-authority checks, Ruff, Mypy, and 350 TypeScript tests all passed. The final differential checks out origin/main, where task_lease_workspace.ts still imports BARE_SHA256_PATTERN twice; start-goal --guided then exits 1 with diagnostic_code=runtime_exited_before_ready. The exact candidate command exits 0 after this PR removes the duplicate import. Because the base probe aborts before writing a receipt, the existing measurement-only path cannot compare the repaired candidate.

Failed job evidence: https://github.com/loopx-project/loopx/actions/runs/36815828212/job/110221256059

Please review the exact head with this base-side CI deadlock in mind. I will keep watching the refreshed checks and will only change the branch for a candidate-attributable failure.