fix(release): bind Linux ARM64 passport evidence

[dongkeren]

Summary

• derive the KFD-3 prebuild surface set from the canonical collaboration-interface registry
• declare Linux ARM64 in the KFD-2 four-platform package trust claim
• advance the immutable release contract to 22.22.3-kf.5-alpha.3
• lock registry/prebuild surface equality and four-platform trust evidence in lifecycle tests
• refresh KFD-1/KFD-3 generated witness hashes

Verification

• node --test .gyp/libnode-entrypoint.test.js .gyp/libnode-kfd-release-evidence.test.js
• corepack pnpm verify-kfd-witnesses
• corepack pnpm verify-release
• corepack pnpm verify-package-source
• corepack pnpm exec prettier --check .gyp/libnode-kfd-witnesses.js .gyp/libnode-kfd-release-evidence.test.js
• git diff --check

Fixes the fail-closed release-passport finalization exposed by alpha.2 without bypassing KFD gates.

[kungfu-origin]

Independent review: the canonical KFD-3 registry now drives the embedded prebuild surface set, Linux ARM64 is present in the KFD-2 artifact coordinates, and generated KFD-1/KFD-3 hashes are consistent. Approval is bound to the current head.

[kungfu-origin]

Independent review bound to 776af58: the canonical KFD-3 registry drives the prebuild surface set; Linux ARM64 is present in KFD-2 and regression coverage; alpha.3 avoids mutation of the already published alpha.2 package set; generated KFD-1/KFD-3 witnesses and local release gates pass.