M0.14: harden verified deployment negative paths

[pgousdal]

Implements M0.14 fail-closed negative-path qualification for the verified deployment trust path.

Changes:

• add explicit EXPECTED_IDENTITY override for testability while preserving the exact production signer identity by default;
• add scripts/qualify_negative_verification.sh;
• reject wrong OIDC issuer and wrong signer identity;
• reject an unsigned unrelated image and a nonexistent release tag;
• reject invalid runtime and pull selectors and missing VERSION;
• assert negative paths do not emit an accepted immutable Glowing Bear ref on stdout;
• integrate the negative matrix into Runtime-neutral verification CI;
• document M0.14 acceptance criteria.

The signed v0.2.3 release remains the positive qualification target and no existing tag is moved.