Add deterministic remote feed overlays, trust policy, and fetch bounds

[thossullivan]

Problem

Remote feeds are fail-closed, but composition, provenance, signing, freshness, and network limits are not a reusable trust model. URL input replaces rather than governs an overlay on bundled feeds.

Scope

• Define deterministic bundled/local/remote precedence and conflicts.
• Support SHA-256 pinning, publisher/origin policy, freshness limits, and signed envelopes.
• Bound redirects, time, response bytes, feed count, and total bytes.
• Preserve degraded fallback as report-only with no GitHub writes.
• Bind selected feed identities and trust evidence into receipts.

Acceptance / UAT

• Cover timeouts, oversized/chunked bodies, misleading Content-Length, redirects, malformed JSON, duplicate publishers, and conflicting models.
• Use built-in Node crypto for valid, altered, unknown-key, and revoked-key signature tests.
• Identical inputs compose byte-deterministically.
• Any trust/fetch failure blocks writes; fallback stays visibly degraded.
• Packed Node 22 tests pass with zero dependencies.

This extends completed protections #24 and #56 rather than reopening them.