Land validated Lens package integrity source

[smshagor-dev]

Summary

• bring the already validated post-merge Lens integrity commit into main
• require package-manifest.json metadata for required model dependencies
• verify required dependency size/hash on explicit model validation
• reject missing, failed, mismatched, or same-size tampered Lens package dependencies
• remove the one-off Lens apply workflow and patcher after materializing the production source

Why

PR #22 was merged before its self-applying workflow finished. The workflow later produced commit 72810fa1868f6bdfff9a783d1dc76fa087480610 on lens-package-integrity, but that validated production commit never reached main. This PR lands that already-tested commit instead of treating the helper workflow as the final implementation.