Make gd-router release gates truthful

[nicodes]

First native stack layer for https://github.com/aviorstudio/fieldsofrevik/issues/152. Adds mandatory negative/restored/reachable Godot runner controls, checksummed Godot 4.7.2, closed-manifest exact ZIP verification, installed-package editor enable/restart/smoke/disable/restart ownership tests, immutable action pins, and least-privilege tested-byte release handoff. Team No Review: no review requested or awaited.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[nicodes]

Self-verification evidence (Team No Review)

• Issue / layer: fieldsofrevik#152, A12-L0 truthful gate.
• Source: aviorstudio/gd-router, a12-truthful-gates, head 9f19061a269b1f3eebca32c4b969c3e3169dc9dc; baseline d351d32f903051d72d14588d03b2e9a49d1f301f.
• Exact-head PR CI: PASS, run 34717977542 for this head (GitHub tested merge ref 59edaa6 against current base).
• Engine/tool identity: Godot 4.7.2.stable.official.ed1daf0bf; Linux x86_64 archive SHA-512 9aa00f…54c65; export templates SHA-512 ca4d71…b84079; playwright-cli 0.1.18, Chromium/WebGL2, 1280×720.
• Runner controls: runtime error with zero exit, overwritten failure, unreachable assertion, parse/load failure, timeout, and missing script all failed as expected; restored fixture passed with reachable=1 assertions=1; shipped suite passed its exact sentinel.
• Exact package: closed manifest 35 files; symlink/traversal/undeclared entries rejected; ZIP SHA-256 ec70166fde74625f2915b1a06546f2ece1a60005cbd353bc6a52cc6fad862e42; installed-tree SHA-256 743920164c197f4af1869694c065d80b699c51573652f5019026f1efd94fa054.
• Installed bytes: PASS enable → editor restart → smoke → disable → restart; plugin-owned autoload removed and consumer-owned autoload preserved. Godot 4.7.2 headless editor automation emits a reproduced, exact allowlist of shutdown-only RID/resource leak lines; all other ERROR, SCRIPT ERROR, and FAIL tokens remain fatal.
• Web path: exact installed ZIP exported with the checksummed 4.7.2 templates. Personal Playwright run at 1280×720 had 0 console errors and logged PASS gd-router web_package_smoke reachable=1.

Commands: GODOT_BIN=<checksummed-4.7.2> ./tests/test.sh; ./scripts/package_addon.py; WEB_EXPORT_DIR=/tmp/opencode/gd-router-web GODOT_BIN=<checksummed-4.7.2> ./tests/package_lifecycle_test.sh; playwright-cli -s=gdrouter-gate goto http://127.0.0.1:8877, console, screenshot.

Residual/untested: this layer validates supported Linux native and single-threaded Web paths, not uncommitted macOS/Windows/mobile matrices. Release/CD/registry acceptance belongs to the final behavior head and remains pending. No review was requested or performed.