ci: fetch the manifest-pinned Grok CLI the publish source build needs

[apresmoi]

What failed

The publish gate Verify Git-free offline linux/amd64 source build died in the test body, not in the Daimon fixture:

error: 'SPAWNFILE_GROK_CLI_FILE must name the pinned linux-x86_64 Grok CLI executable'
  pinnedGrokCli (scripts/source-provenance-bundle.integration.test.ts:23:46)
  TestContext.<anonymous> (scripts/source-provenance-bundle.integration.test.ts:66:12)

Everything before line 66 — the offline linux/amd64 closure, the shipped daimon.tgz, the broker digest against the vendored contract manifest, and the offline dependency probe — passed. The second half of the test builds the real runtime image and wrapper, and the image refuses any Grok executable but the manifest-pinned build, so the test needs the actual linux-x86_64 binary. CI never provided one.

Fix

A new step fetches it before the gate runs, reading the URL, byte length, and SHA-256 straight from the vendored Daimon contract manifest (src/runtime/daimon/contract-manifest.json), verifying size and digest, and handing the path to the test through a step output. Nothing about the pin is hardcoded in CI: re-vendoring Daimon's contract (npm run vendor:daimon-contract) moves the download with it. The binary is removed with the Daimon fixture so the Moltnet gate that follows keeps its disk.

The gate takes 328 s on a GitHub-hosted runner, against a 360 s test budget and a 20-minute job budget that had never yet had to cover a passing run of it. Both are raised — the test to 900 s, the job to 45 minutes — so a slower runner does not turn a publish red on timing alone. No gate is skipped, relaxed, or made non-blocking.

Not the Daimon fixture ref

Daimon v0.2.0 and main are the same commit (a805ef1), and the pinned broker digest 67e3624d… is byte-identical at both, so a ref: on the fixture checkout would not have changed this run. Fixture drift is already gated by content rather than by revision: the runtime image build cross-checks the Grok CLI pin and the broker digest in the built package against Spawnfile's vendored manifest, and fails the build when they disagree.

Verification

Rehearsed on an ubuntu-latest runner from a scratch branch carrying the publish job's own steps (QEMU, build:native, build, Daimon fixture checkout, the new fetch step, npm run test:source-provenance-docker): the fetch step verified the 163 MB binary in 1 s, the fixture resolved to a805ef1, and the gate reported ok 1 … # pass 1 # fail 0 in 328 s. npm run typecheck and npm run test:scripts pass locally.