docs: finalize fixture canary evidence

[zsumz]

What changed

• replaces every staged-canary PENDING field with verified publication evidence
• records the npm trusted publisher, 2FA approver, public integrity, and finalizer artifact
• records the immutable GitHub prerelease and successful replay-safe no-op
• documents independent byte identity across the candidate, npm, and GitHub tarballs

Why

The acceptance record should close only after the public registry bytes,
provenance, GitHub bundle, and replay behavior have been independently checked.

Validation

• git diff --check
• npm run release:check
• public npm and GitHub tarballs compared byte for byte with the sealed candidate
• finalizer replay 31339527592 completed as a verified no-op
• commit verified as OpenPGP-signed by zsumz <shawn@zsumz.com>