[FLO-3.6] Integrate an immutable Renderflow release

[szmyty]

Parent: #3
Suite roadmap: #11
Depends on: #49 and egohygiene/renderflow#419
Coordinates with: #31, #32, #10, egohygiene/renderflow#414, and egohygiene/renderflow#416

Outcome

Add the production Renderflow adapter so Flow can turn immutable ordered comic/page artifacts into validated final publication artifacts through an independently released provider.

Acceptance criteria

• Pin the exact Renderflow release, artifact digests, CLI/API contract, schemas, tools, and declared effects.
• Implement availability/version probing and exact capability negotiation.
• Map ordered collection identity, member order/digests, publication geometry, configuration, and output requirements into canonical Renderflow plans.
• Preserve deterministic planning, cache/checkpoint identity, validation evidence, provenance, cancellation, and resume semantics.
• Prove at least the released print-interior PDF and fixed-layout EPUB routes without overstating unpublished channels.
• Refuse incompatible versions, reordered or changed collections, unsupported formats, and invalid outputs with typed diagnostics.
• Add clean-room end-to-end fixtures suitable for the static comic proof in [FLO-13.5] Prove the static publication workflow with released providers #32.
• Generate operator documentation and compatibility evidence from tested truth.

Cross-cutting requirements

• Pin an immutable provider release by exact version and digest.
• Translate provider-native failures into Flow's typed diagnostics without discarding original evidence.
• Preserve source artifacts; no provider may receive mutation authority implicitly.
• Record provider identity, contract/schema versions, capability discovery, arguments, environment assumptions, and output digests in durable run evidence.
• Exercise clean-room installation and an end-to-end fixture through the public Flow API.
• Keep unsupported capabilities explicit and fail closed.

Non-goals

• Importing provider source into Flow.
• Shell-interpolated command execution.
• Claiming capabilities the pinned provider release does not prove.