fix(deploy): avoid full private provenance downloads

[allenwoods]

Summary

• fetch only the provenance branch's commit/tree graph with blob:none
• fetch the reviewed config and manifest blobs on demand
• copy each working source file once, then require both its remote Git object ID and manifest SHA-256
• normalize staged modes from the remote tree and re-check checkout integrity before and after materialization
• fail closed on ignored blob filters, promisor/partial-clone config, conversion filters, fsmonitor hooks, object alternates, and submodules

Root cause

The content publisher previously fetched the complete access-controlled repository into a fresh bare repository for both dry-run and apply. Unrelated archives and binary history made that provenance proof unnecessarily slow and duplicated the transfer for every release attempt.

The new flow keeps the remote commit, tree, config, and manifest authoritative without downloading unrelated source blobs or history.

Verification

• bash deploy/content/tests/run.sh — 31/31 passed on GNU Bash 3.2
• python3 -m unittest discover -s scripts/ci -p 'test_*.py' -q — 53/53 passed
• scripts/check-public-repository-boundary.sh — PASS
• Bash syntax checks — PASS
• git diff --check — PASS
• independent adversarial review — no remaining P0/P1/P2

Deployment

No deployment is performed by this PR. The content-only production flow will be exercised only after this change is promoted to prod and the access-controlled release wrapper pins that exact revision.

[allenwoods]

@FatNine when you have a moment, please review this exact head. Both required CI paths are green, the production dry-run completed without mutation, and the adversarial review found no remaining P0/P1/P2. The repository ruleset intentionally requires a non-author CODEOWNER approval, so I will not bypass it.