fix(0.4): refresh Linux operation bundle closure

[ael-dev3]

Problem

The protected Linux production preflight rejected current 0.4 because the checked-in sealed operation bundle manifest still referenced the pre-duration source family. The G001 lane and its source closure had drifted from the current protected runtime source, so deployment could not reach provider or owner gates.

Change

• Rebuilt the four deterministic Linux operation lanes from the accepted 0.4 runtime source (d2fe2d2c146d137b78c062df4d935a5cfb7766f9) with the pinned Linux Node 22.22.3 toolchain.
• Refreshed the operation bundle manifest and G001 bundle digest/source closure.
• Re-derived the 1,215-member auth-bridge deployment closure and updated the four protected workflow manifest pins.
• Kept G002 sealed and PTR owner-only; no provider state or credentials were changed.

Validation

• Dedicated Linux preparation runtime: two-cycle deterministic build/load passed for activation, G001, G002, and PTR.
• Auth-bridge closure derivation: 22 passed, 2 skipped.
• Operation bundle and Linux preflight suites: 79 passed, 44 skipped.
• Linux closure executable verification passed with 1,215 members.
• git diff --check passed.

This PR only refreshes source-bound generated artifacts and their attested closure. It does not claim live deployment or owner acceptance; those remain subsequent release gates.