fix: align governance receipt freshness with commit lifecycle

[alexhraber]

Follow-up to #1106.

This PR corrects the governance inventory validation-receipt freshness rule. Decapod emits the receipt before the commit that carries it, so requiring the embedded receipt Git SHA to equal the eventual commit head is an impossible circular condition. Freshness now relies on receipt integrity plus binding to the current trajectory; the current checkout SHA remains separately reported as workspace state.

• Keeps all four governance artifacts semantically current after publication.
• Adds no new credential or provider behavior.
• cargo fmt, Clippy, focused tests, and decapod validate pass locally.
• The preceding PR's required GitHub checks were green.