chore(review): remove overengineered validation guards

[ssfun]

Summary

• remove redundant daily full latest-upstream CI while retaining manual latest validation and automated release gates
• simplify overlay provenance to reviewed upstream hashes while preserving fail-closed collision checks
• retire implementation-shape and brittle workflow/Docker string-scanning tests
• record the simplification rationale and retained risk controls in the review report

Validation

• repository validation: 19 Management customization/security tests and 2 reproducible archive tests
• fresh Management v1.18.5: repeated application, 110 Bun tests, ESLint, TypeScript, production build
• fresh Core v7.2.94: guarded preflight, rejected reapplication, target Go packages, server build
• source Docker build deferred to the required source-image-build PR check because Dockerfiles are unchanged