Fix deploy catalogues against installed R2 packages

[alowpoly]

The deploy failure came from two mismatched assumptions introduced by #427: catalog-only preparation still regenerated volume provenance from authoring inputs, while the Astro availability gate required R2-hosted preview files to exist under local public/scenes. This change makes catalog-only preparation read the exact prepared metadata installed by setup:assets, and makes ASSET_ORIGIN builds validate preview identity through each object runtime-assets manifest instead of requiring a local copy. Local builds remain byte-strict against public/scenes.

Validation:

• 16 focused availability/setup tests pass
• 10 deploy workflow checks pass
• tools and config typechecks pass
• asset-origin and volume-presentation tests pass
• direct read of the tracked R2 metadata validated 15 prepared contexts, 35 datasets, and every provenance source-manifest hash without writing or downloading the asset corpus