Canonicalize nested runner release signatures

[Augani]

Root cause

Xcode 26 signs the filesystem XPC and enclosing Hypervisor runner with a valid but broader designated requirement that includes an Apple Development compatibility branch. The schema-2 component inventory intentionally requires Dory's exact Developer ID requirement, so otherwise-valid optional component candidates fail closed.

Fix

• normalize only the filesystem worker and enclosing runner, inside-out
• preserve their exact entitlement plists and hardened-runtime timestamped signatures
• leave the qualified renderer worker and signed renderer inventory untouched
• verify the exact requirement before binding runner/worker identities into doryd
• cover signing order and renderer immutability in component packaging tests

Verification

• bash -n scripts/bundle-engine.sh scripts/test-build-components.sh
• scripts/test-build-components.sh
• full throwaway schema-2 component candidate assembly + independent verify-candidate against a locally notarized Dory 0.4.6 candidate