v0.6.4

Consumer repositories now load the immutable policy core supplied by the pinned public runner instead of maintaining a byte-for-byte local copy. The runner binds the core path and version before enforcing tracked-source policy. Legacy vendored-core consumers remain supported during migration.