fix: harden workflow and payload validation

[CodeSigils]

Summary

• reject symlinked canonical sources and runtime payload entries
• correct uv-managed project setup, verification commands, and classification precedence
• require complete CI gates and immutable action pins with negative-path regression tests

Root cause

Payload checks followed declared symlinks while orphan discovery ignored them, the documented uv commands bypassed the managed environment, and CI policy checks relied on incomplete substring assertions.

Validation

• repository portability, source, CI-policy, and payload validators
• CI-policy and payload regression tests
• pinned Ruff 0.12.4, ShellCheck, Bash syntax, and diff checks
• all 15 external URLs
• fresh generated-project smoke test covering uv sync, Ruff, mypy, pytest, sdist, and wheel build