build(release): integrate native 0.4 prepared outputs

[ael-dev3]

What this changes

Integrates the native Linux M2 prepared outputs for Warpkeep 0.4 after the source-only M1 on main. This commit is generated-only: it changes the four protected release workflows, three sealed-realm lane bundles, and the three closure/bundle manifests. No application source or release approval state changes.

Provenance

• M1 source commit: e6c6064cdfd81a057db6d1b04c801e417bbab41c
• M1 source tree: 63d67c3b3f27b4d4e778956555d2b4ed429bafef
• Native preparation profile: warpkeep-spacetime-binding-final-preparation-linux-x64-v1
• Native transaction: 650fc4ca919adabeba28ae4606b2bf91
• Native journal SHA-256: 492fcc2bc92307c1a656213899d9cfdfba777c33c18c0576ef275f59df1f4512
• Native family SHA-256: 598aad8cf82e20be390c6f4a0709f0f8ce35bf2ff9127a6827653204aaea670
• Native closure manifest SHA-256: cd3cee166186b607e13d0a1c81f89fb8ff9e13bf29121fc6d872dd957edf253b
• Native scanner manifest SHA-256: edebf17145ef78a7ff921041dcc5b5916c94de10a522bd87dbe21461849e1e71
• Generated patch SHA-256: 6b913917375cb3cff5c4f933604ad47d8e036198754a36a0212c5dd0fd288466
• Candidate counts: 3,250 checked source files, 624 bundle inputs, 102 generated outputs

Validation

• Native Linux Vitest: 6 files, 221 passed, 0 failed, 0 skipped
• Windows pinned Node batch: 131 passed, 14 skipped; remaining failures are Linux-only executable/symlink fixtures and were not used as release evidence
• git diff --check: passed
• Pinned Gitleaks: passed with no leaks
• Main Verify and CodeQL for the source-only M1: passed

The PR must pass the repository Verify and CodeQL checks before merge. The generated outputs are intentionally kept separate from the source M1 so the protected workflow can review their exact byte changes.