Prove committed foreground-work inputs with fan-out

[bigboateng]

Summary

• add a generated foreground-work-input-proof Flow using the candidate from operatorstack/boatstack#233
• bind consumers B and C to Work A's required architecture output
• retain implementation-plan as the separately selected planning output
• pin the candidate SDK packages, runtime identity, compiled Flow artifact, and generated host projections

Verification

• all three committed Flow artifacts pass boatstack flow check with the candidate runtime
• npm --prefix projects/basic-react run check
• npm --prefix projects/basic-react run build
• the generated proof reached approved-plan
• B and C sealed identical producer receipt, result, contract, output, and SHA-256 provenance while producing independent consumer results
• the generic package manifest and approval contained no plan fields; the promotion receipt alone selected implementation-plan