Implement bundle-only HFS provenance

[BlueSkyXN]

HFS v2 delivery profile

• lane: source
• sovereignty: port
• production Space: BlueSkyXN/libreFS-HFS
• candidate Space: owner-gated
• rollback Git baseline: af31b9bdf07e89fad3a84156f0993f2c75e1a317

Summary

• commit the reviewed HFS v2 manifest, wrapper/exporter, workflows, tests, and no-secret templates
• enforce immutable source/artifact provenance and fail-closed deployment boundaries
• keep remote writes manual, allowlisted, and followed by readback

Validation

• bundle-only contract and clean provenance export verification; alignment 0 ERROR
• independent clean-worktree validation and actionlint passed

Remote gates not covered by this PR

• GitHub-hosted build/CI result at the exact PR head
• artifact or source-wrapper publication readback
• candidate/production Space build, health, business smoke, persistence, backup, and isolated restore
• seven-day observation and legacy-resource cleanup

Owner gates

No automatic merge, production cutover, Space cleanup, bucket deletion, or Settings pruning is authorized by this PR.