Rebase PR #52 onto staging and resolve conflicts

[amiller]

PR #52 (staging-49 → staging, "RFC 0025 Phase 1: per-app attestation binding quote (daemon-vouched)") is CONFLICTING against staging. Rebase it and resolve.

Task

• Rebase staging-49 onto current staging.
• staging is canonical for anything merged after this branch forked; preserve the PR's own semantics (per-app attestation binding quote, daemon-vouched) on top.
• Resolve every conflict by hand — no conflict markers left. Attestation/source-binding code on staging has moved recently (cf. Tier-0 regression: source binding missing on fresh attested deploys (since PR #69) #70 source-binding regression, Durable per-app version ledger — provable 'this URL only ever ran these N versions' #61 version ledger) — reconcile onto the current binding path, don't reintroduce superseded logic.
• Re-run the repo's fast checks.
• Push with --force-with-lease.
• Comment on PR RFC 0025 Phase 1: per-app attestation binding quote (daemon-vouched) #52 listing which files conflicted and how each was resolved.

Acceptance

• PR RFC 0025 Phase 1: per-app attestation binding quote (daemon-vouched) #52 shows MERGEABLE.
• No conflict markers; checks green; comment posted.