[Security] Prove secure Provider Nacos registration in Stack

[XnLemon]

Context

Samples PR #10 adds explicit private-CA and mTLS transport for Provider-side Nacos registration. Core Router discovery (#111) already has the corresponding fail-closed HTTP/gRPC TLS boundary.

Acceptance

After NeKiro-project/NeKiro-Samples#10 merges, pin its complete merge commit in components.json and add a Stack acceptance profile that:

• starts a TLS-enabled Nacos fixture with a private CA and explicit server name;
• starts Runtime A and Runtime B with secure Nacos registration;
• proves both Provider leases are visible in Nacos and observed by Router;
• invokes through Router only and verifies Ledger lineage and exact instance identity;
• proves wrong CA/server name and missing mTLS client credentials fail startup and never produce a routable stale instance;
• keeps HTTP, HTTPS TLS, and HTTPS mTLS behavior distinct without fallback or downgrade.

The Stack PR must pin Core, Samples, SDK, Console, and transport revisions to complete immutable SHAs and keep the acceptance failure visible.

Dependency

Blocked on NeKiro-project/NeKiro-Samples#10.