Add Phase 4 node toolkit and Celestia payload gates

[acedward]

Summary

• pin the frozen Midnight node/toolkit 2.0.0-rc.4 and Celestia app/node releases at exact commits, trees, assets, sizes, and SHA-256 digests
• safely repackage official node/toolkit Linux inputs and preserve Celestia Linux-arm64 upstream bytes
• build the missing toolkit macOS-arm64 payload twice on exact native macos-15 jobs, compare bytes, inspect signature/linkage, and run the clean-host plus exact show-address contracts
• emit SBOM, provenance, member, system, probe, and digest evidence as inert workflow artifacts only

Safety boundary

• development-only, mutable warehouse 0.3.120 metadata
• read-only workflow permissions; this PR does not publish or modify any release
• official Linux toolkit bytes are repacked, not rebuilt
• macOS output is explicitly UNSIGNED_DEVELOPMENT_ONLY and rejects Developer ID authority

Local verification

• actionlint 1.7.12: PASS
• workflow least-privilege policy: PASS
• catalog/schema semantic validation: PASS (6 components)
• Docker Python 3.12 full suite: PASS, 30 tests / 1 environment-tool skip
• deterministic/safe-extraction Phase-4 fixtures: PASS