Prove NLBoot release-candidate workflow

[mdheller]

This PR exists to trigger and prove .github/workflows/release-candidate.yml through the normal pull-request path.

Scope:

• add docs/RELEASE_CANDIDATE_PROOF.md only;
• no runtime behavior changes;
• no host-changing behavior;
• no release publication.

Acceptance:

• release-candidate workflow runs;
• workflow either succeeds and uploads the RC artifact, or fails with actionable logs for the next hardening PR.

[mdheller]

@copilot Please fix the remaining RC failure on this PR branch. Root cause: Rust canonical_manifest_payload does not match Python reference canonicalization. Python signs compact JSON with sorted keys: json.dumps(unsigned, sort_keys=True, separators=(",", ":")). Update Rust to recursively sort JSON object keys before serde_json::to_vec, preserve array order, then rerun make rust-test and the fixture targets. Keep scope limited to this verifier fix and any necessary workflow cache setting.

[Copilot]

@copilot Please fix the remaining RC failure on this PR branch. Root cause: Rust canonical_manifest_payload does not match Python reference canonicalization. Python signs compact JSON with sorted ke...

Fixed in fdd8c6d.

Root cause was actually two issues:

1. Verifier incompatibility: ring's parse_public_key expects PKCS#1 RSAPublicKey DER (just SEQUENCE { INTEGER n, INTEGER e }), but the trusted key PEM is SubjectPublicKeyInfo format. Replaced ring with rsa = { version = "0.9", features = ["sha2"] } which correctly handles SubjectPublicKeyInfo via RsaPublicKey::from_public_key_pem().

2. Explicit key sorting: Added sort_value_keys() helper that recursively sorts JSON object keys by explicitly sorting entries before collecting (matching Python's json.dumps(sort_keys=True, separators=(",",":"))) and preserving array order. Used in canonical_manifest_payload().

All 13 Rust tests pass. make validate, make rust-check, make rust-test, and all fixture targets pass.