test(stack): prove secure Provider registration

[XnLemon]

Summary

• pin Core #111 merge 8c385babc9da4c383a0aaa9efe1daeb0b72dd812 and Samples test(stack): prove secure Provider registration #10 merge 1dcfae990564febdb545c4d02408f3f2991aa5a0
• generate an ephemeral private PKI inside backend acceptance without committing test keys
• publish Runtime A's exact-Release lease through authenticated TLS
• publish Runtime B and its replacement through mTLS
• keep discovery, Router-only invocation, nested re-entry, replacement recovery, cancellation, and Ledger assertions on the same product E2E
• prove wrong CA, wrong server name, and missing mTLS client identity fail before registration and leave no Nacos instance

Component revisions

• Core: 8c385babc9da4c383a0aaa9efe1daeb0b72dd812
• Console: 6084e0d57edd97635f7982d6813ca6857b45c7f1
• Go SDK: 39c37c8929b5f2b811342b3784abc72da3d59d8f
• Samples: 1dcfae990564febdb545c4d02408f3f2991aa5a0
• A2A transport: ca9255ad9cf63f98ce074d1bded8089a6a29f1d8 (v0.1.1)

Validation

• go run ./cmd/manifest-validator components.json
• go test -count=1 ./...
• go test -race ./...
• go test -tags=e2e -run '^$' ./tests/backend
• go vet ./...
• docker compose --file compose.yaml config --quiet

Full container acceptance is delegated to the required Stack backend CI because the local Docker daemon is unavailable.

Security and fallback

• private keys are generated only in the caller-owned runtime directory and bind-mounted read-only
• no system-root trust, TLS downgrade, alternate endpoint, retry, or stale registration success is introduced

Fallback delta: removed 0, retained 0, added 0, net 0
Added fallback evidence: none

Closes #9