feat: publish signed public verification proof

[echo-fleet-builder]

Summary

• publish secret-safe, signed public verification projections bound to exact source, environment, and production-E2E evidence
• add production profiles for Echo GitHub Autonomy and Echo Continuity Fabric
• require one shared fail-closed public HTTPS canonicalizer for generic proofs
• preserve raw account, private repository, credential-route, and per-client evidence outside public responses

Verification

• full repository suite: 741 passed, 3 skipped
• focused adversarial public-proof suite: 101 passed
• changed-file Ruff and formatting checks: passed
• Python compilation: passed
• staged secret scan: zero findings
• two independent reviews: no actionable P0-P2 findings

Governance

Draft only. No automatic merge or deployment. The branch was developed from agent/deployed-sandbox-resource-profile; review the full main-relative chain. CertForge must be deployed and independently verified before the Autonomy certificate-authority branch is eligible for its production ceremony.