vNext D2: harden preview bundle readback evidence

[Pigbibi]

PR #49 intentionally delivers the bounded daily-only D1 vertical slice. Before any production publisher/Pages integration, harden the preview evidence/readback boundary:

• reject symlinks and non-regular files before reading fixed bundle entries
• deep-freeze or otherwise make returned evidence recursively immutable
• validate manifest.source is a mapping before inspecting keys
• enforce canonical manifest.json bytes, not only semantic equality
• explicitly adjudicate whether an exact source contract_version=model_recommendations.v5 field is accepted or forbidden; keep source/manifest contract documentation consistent

This is non-blocking for isolated D1 preview acceptance, but blocking for production integration.

[Pigbibi]

Additional D2 items from the final head review: (1) replace the POSIX directory rename with a true no-clobber publication primitive or explicit trusted single-writer contract, because rename may replace a concurrent empty destination; (2) include symlink/non-regular entry rejection in the readback hardening.