Fix terminal replay after target digest reconciliation

[echoomegaprime]

What changed

• converge exact idempotent replay after terminal target-digest reconciliation
• retain immutable request, dispatch, project, policy, type, and reference binding
• require released reservation digest to match the terminal acquired run digest
• add the exact-Git terminal replay regression
• complete the Certification Forge repository showroom contract and CodeQL v4 workflow

Verification

• python -m pytest -q: 627 passed, 1 skipped
• P7 subscriber-governance suite: 60 passed
• targeted replay regression: passed
• python scripts/p1_acceptance.py: passed for the code change
• python -B scripts/certification_journey.py: 8/8 apps, 60 capabilities, renderer PASS
• local GitHub App showroom evaluator: passed with zero failures
• JSON, YAML, and SVG XML parsing: passed
• all four committed SVG assets rendered and visually inspected

Deployment boundary

Production promotion remains gated on authentic exact-commit Certification Forge evidence and the repository's staging-first deploy gate. GitHub Actions is currently disabled account-wide by GitHub, tracked under support ticket #4663295, so hosted CI is an external outstanding gate and is not represented as green.