feat(cloud): add reproducible stack compatibility lock

[ZhiXiao-Lin]

Summary

• register Cloud, Runtime, and ORM as pinned submodules and advance Flow, Gateway, and Sentry to the compatible release set
• add a canonical ACL compatibility lock covering 10 components and 6 protocol levels
• verify gitlinks, submodule URLs and cleanliness, Cargo manifests and lockfiles, exact Cloud/Gateway bindings, protocol declarations, and ACL-only Cloud configuration
• add a clean-checkout CI gate that builds the locked Cloud workspace, runs Cloud contract fixtures, and checks Gateway with the Sentry wire feature
• document the compatibility update and publication process

Compatibility evidence

Lock digest: sha256:ce9ebd3af1cd5a2c972bd5f9e553bb9e77614b6b31bf03fe205a721d9097fe99

The lock aligns Gateway 1.0.12 with ACL 0.2.2 and Updater 0.3.0. It also aligns the optional Gateway wire surface with Sentry 0.7.0.

Validation

• just cloud-stack-check
• 5 Node compatibility-policy tests passed
• Cloud workspace cargo check --workspace --all-targets --locked passed
• 10 Cloud contract tests passed
• Gateway cargo check --locked --all-targets --features wire passed
• workflow YAML and staged diff checks passed

This is the first verifiable clean-checkout compatibility-lock slice for #21. It intentionally leaves the issue open for broader release publication evidence and any future cross-repository service fixtures.