Make Problems projection reconstruction public and pin Vela 0.977.6

[williamjblair]

Summary

• pin projection generation and vendored schema provenance to signed/released Vela 0.977.6
• emit public unauthenticated source-adapter artifact references from vela-science/problems while retaining historical private v2 references as read-only history
• move release asset custody and exact-checkout validation to the public Problems repository
• expose an explicit noncanonical preactivation reconstruction mode; production parity remains required by default
• remove current-facing references to the absent apps/www and dev:www surfaces

Qualification

• bun run check
• bun run lint
• bun run test
• bun run test:roots
• bun run test:manifests
• public source acquisition: 12 bundles, 6,631 native records, set root sha256:94fd9548054d7438df1f3b6a71821c437b5a4cb35f3ea4d27028782b5b60b618
• two independent empty-Postgres reconstructions from clean commit 1d8dbf8: byte-identical and SELECT-only; candidate macOS release root sha256:a1f3e96d4ecc37d8a1422a2ee445f796694e2f4f129ad21a1a4f8ca702fb72d5
• released macOS Vela binary digest sha256:5b21415c98503b20518c0e68714b0b4f4b3c371525ea110563b89a53a0d3dbb3 verified against signed release manifest

Cutover boundary

No deploy or Neon mutation is included. The production build correctly refuses the currently active Vela 0.977.3 projection. C1 must retain the public artifact, activate and verify the 0.977.6 derived projection, rerun required production parity, and deploy the exact accepted commit before the build/budget gate can pass.