Update Kotlin runtime security packages

[p13i]

Summary

• pin the fixed Alpine libexpat, p11-kit, and p11-kit-trust packages in the Kotlin build stage
• regenerate the reviewed AMD64 image inventory from the patched image
• rebind the demo evidence manifest to the resulting source tree

Validation

• make verify
• make codec
• Black 24.10.0 across all Python paths
• WSL Docker build, formatter identity, smoke test, and golden parity
• canonical inventory regenerated from an independently rebuilt AMD64 image

---

Written by Codex