Bind Argo bootstrap to reviewed CLI renders (#33)

[AntoineToussaint]

Closes #33.

Summary

• Makes the CLI's reviewed render inventory and released Core promotable evidence the authoritative service graph, so Argo cannot deploy an independently assumed or mutable snapshot.
• Binds one selected environment to the exact reviewed commit while giving local k3d qualification separate publication and fetch URLs without weakening revision checks.
• Keeps the bootstrap least-privilege boundary intact for secrets, managed handoffs, routes, cluster ownership, and topology-derived network access, including the Mind users graph.

Test plan

• go test -count=1 -race ./...
• go vet ./...; staticcheck ./...; golangci-lint run ./...
• GOWORK=off go test -count=1 ./... in module/tools and every Go service
• node module/tools/base-integrity.mjs check; node --test module/tools/base-integrity.test.mjs
• npm test; npm run lint; npm run typecheck in the frontend service
• node module/tools/marketing-extraction.mjs
• codefly ci run --all --phase verify,sync-drift --jobs 4
• Codefly lint, compile, and service-test phases in a fresh isolated runtime (16 passed, 0 failed)

Coordination

The version 2 inventory is the shared serialized boundary for codefly-dev/cli#156. Older inventories and non-promotable plugin output are rejected intentionally.