fix(ci): bind CNPG runtime proof policy

[bntvllnt]

Summary

• require signed CNPG image-equivalence proof schema v4
• bind exact runtime projection and 20-field neutral-default policy
• canonicalize Docker serializer defaults identically in independent authority
• assert exact neutral removal plus non-neutral and wrong-type retention

Verification

• workflow YAML parsed with yq
• embedded Bash: bash -n and ShellCheck PASS
• full local authority run rebuilt with network disabled from exact preloaded dependency image: PASS
• signed proof and tampered-proof negative control: PASS
• cleanup: zero authority images, containers, or temp directories

Companion: vllnt/infra#461

The sovereign runner and organization required-workflow ruleset remain separate blockers; this workflow is still non-enforcing until those controls ship.