Fix public fingerprint canonicalization in v0.1.18

[luisleo526]

What changed

• sync the shipped runtime harness exactly to pineforge-engine v0.12.2
• emit RFC 8785/JCS-compatible fingerprint bytes, including canonical integral floats
• include canonical source-tape identity and guarded trade entry incarnation output
• bump the release bundle to 0.1.18
• add a focused Python/Node CI gate for the production boundary

Why

The first v0.1.17 production probe proved that the decoded token and digest were internally consistent, but the release image still owned an older copy of docker/run_json.py. Its token encoded integral floats as 0.0, 1.0, and 12345.0 and omitted the engine source-feed fingerprint identity. The engine v0.12.2 fix therefore had not crossed the actual image boundary.

Validation

• focused release boundary: 31 passed, 0 failed
• engine fingerprint suite against this exact release copy: 273 passed, 0 failed
• 50,000 random finite binary64 values versus Node NumberToString: 0 mismatches
• full-file py_compile, YAML parse, and git diff --check: pass
• docker/run_json.py is byte-identical to the engine v0.12.2 source

After merge, v0.1.18 will be tagged with engine=0.12.2 and codegen=0.10.1, published, fanned out to both MCPs, and verified against the live public endpoint.