Revoke superseded zero-swap beta candidate

[jremick]

Summary

• permanently revoke source 307263070dfa077889243bf8decd121e6e430834
• permanently revoke candidate digest sha256:6fd3167f28099a6f41309db2a535120a1e5fde1f862e2f230e9fa282546ff363
• retain replacement source c7b6deff54a78ede279d607e38bfe8df2bec3582 as eligible

Why

MediaNAS validation proved that Docker normalizes MemorySwap to -1 on a host with zero usable swap. The superseded source's validators rejected that documented safe fallback. Replacement source c7b6deff54a78ede279d607e38bfe8df2bec3582 accepts the fallback only when bounded host evidence proves SwapTotal is zero.

Verification

• production release-policy jq schema and uniqueness gate: passed
• old source identity rejection simulation: passed
• old digest identity rejection simulation: passed
• replacement source/digest eligibility simulation: passed
• npm run build: passed
• npm run test:packaging: passed
• npm run verify:docs: passed
• npm run verify:secrets:tracked: passed
• independent read-only diff review: passed

Release boundary

This PR changes only the revocation ledger. It does not create or promote a semantic Git tag, image tag, or GitHub release, and it does not touch MediaNAS or EXP.