docs: record staged fixture canary

[zsumz]

What changed

• records the sealed v0.0.2-fixture.0 candidate receipt and independent hashes
• links the protected PR, main and tag CI, Sallyport run, and provenance entry
• records npm publication, finalization, and GitHub Release as PENDING
• includes the exact maintainer 2FA commands for the staged candidate

Why

Acceptance evidence should distinguish a successful stage from a completed
publication. This preserves the current, externally supported state without
inferring approval from an absent registry version.

Validation

• git diff --check
• npm run release:check
• commit verified as OpenPGP-signed by zsumz <shawn@zsumz.com>