release(provider): cut the resource contract candidate

[rldyourmnd]

Outcome

Cuts provider derivative v0.1.5-nddev.41 for the hard-memory/resource-contract change and makes its binary identity reproducible and machine-verifiable.

• manifest version and all portable configs move together
• manifest records exact source commit, SHA-256, clean-VCS state and build contract
• fleet contract exports provider commit/digest
• hosted CI checks out the exact source commit, rebuilds twice outside the worktree and verifies the declared digest

Artifact identity

Source: bb11bfbfb107e63f623d29dd417555e4a44bbfde

Provider .41 static binary: 69180b40d2b573854958cf10b10aceecd82d90be14360bb700d44d5443d1871f

Build contract: Go 1.26.6, linux/amd64, CGO disabled, trimpath, empty build ID, clean VCS, two identical rebuilds.

The gate rejected both the C-toolchain-dependent build and a locally dirty-source build before deployment. No rejected artifact was deployed.

Verification

• make verify
• exact manifest/config version parity
• two pristine exact-source local rebuilds
• hosted reproducible-provider gate on the exact source commit

No fleet host is mutated by this PR.