fix: close final release-audit gaps

[demirelo]

Summary

Closes the two final release-audit findings:

• reject duplicate resolved declarations in the public axiom-audit manifest;
• add the Minmod periodic mass-preservation extension to the authoritative source map;
• document that lake update may refresh the dependency manifest and that CI uses the committed lock.

Verification

The focused Lean acceptance module, full library build, dynamically discovered Lean acceptance modules, contract checks, numerical reproductions, and tracked-tree security scan were run locally.

Decisions and risks

This is a repair to the merged CN-07, CN-09, CN-10, and CN-11 surface. No signed statement bundle changes. The external builder panel was degraded by provider/runtime output; local proof and negative-control gates remain authoritative.