Assemble the digest-locked Echo Edict provider package

[flyingrobots]

Purpose

Assemble generated metadata and Echo-owned components into one provider distribution accepted by Edict's landed edict.provider-manifest/v1 contract.

Required package contents

• generated lawpack, target profile, authority facts, CDDL schemas, provenance, and review projections from Generate Echo Edict lawpack, target profile, authority facts, and provenance #652;
• lowerer component from Implement the Echo Edict WIT lowerer component #653;
• verifier component from Implement the Echo Target IR semantic verifier component #654;
• exact ascending domain-to-schema bindings;
• one generated provider manifest with explicit roles, contracts, coordinates, and SHA-256 digests.

Acceptance criteria

• Metadata artifacts use generated provenance; lowerer/verifier use component provenance.
• Every artifact and schema binding is explicit, unique, digest-locked, and supported.
• Manifest ABI and selected world identities exactly match Edict v1.
• Edict manifest binding, immutable schema-registry construction, component digest/attestation/type preflight, and request proof all pass.
• Missing, duplicate, reordered-conflicting, wrong-source, wrong-digest, wrong-contract, and tampered bytes fail before guest execution.
• Package assembly is deterministic and has check/write modes.
• No mutable-name lookup, registry resolution, network fetch, or lazy schema load occurs during invocation.

Blocked by #652, #653, and #654.
Parent: #650