Fix Commander XP verifier digest authority separation

[0xNad]

Summary

Publishes the independently reviewed relay correction for Commander XP provenance verification.

The verifier now treats these as three distinct authorities instead of incorrectly requiring them to share one digest:

• GHCR OCI image digest
• Coworld client_hash
• Coworld container image_digest

It still binds request, projected response, completed-image, container-readback, and cross-arm consistency surfaces fail-closed.

Relay evidence

Exact relay result: 2026-08-25-commander-verifier-digest-authorities-v7

• exact implementation head: 037d931e003aba19a34fe2cb3670191ee685fa7e
• exact base: af0fd98ac33617884ceb839da681c3b6fe5e97d4
• independent Codex reviewer: GO, zero findings
• changed files only: src/server/agents/CommanderXpVerifier.ts, tests/server/CommanderXpVerifier.test.ts
• Commander focused gate: PASS
• focused regressions use three distinct SHA-256 values and cover crossed authorities, malformed hashes, completed-image substitution, and cross-arm substitution
• TypeScript remains baseline-red only on the pre-existing src/server/Logger.ts TS2561 diagnostic; no introduced diagnostics

Current main has advanced to 66db8f5bdbff948e76681f01fb4c912090b6998c; the intervening merged change does not touch either verifier file. Open PR #177 also does not modify CommanderXpVerifier.

No hosted Coworld execution, package/binding mutation, ratings, scheduling, or production/default league changes are part of this PR.