Shell->dag Slice 3 precondition: freeze live_deploy emitted script as a committed golden; kill the #6023 self-referential .contains gate

[gunbai-bot]

Auto-opened by session-dashboard for session swift-ibex-447.
Pushing to session/swift-ibex-447 advances this PR.

Worker attestation

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

live_deploy's "drift gate" (live_deploy_apply_script_drifted/live_deploy_retract_script_drifted) compared expected_live_deploy_apply_script()/expected_live_deploy_retract_script() to itself — a #6023-class self-referential fabricated-green trap with no independent oracle. This PR freezes the current emitted apply/retract scripts as committed golden artifacts (.github/live-deploy-srv1-apply.sh, .github/live-deploy-srv1-retract.sh), registered in the single-authority GeneratedArtifact registry (dag/gunbc/generated_artifact.dag + generated_artifact_emit.dag), parallel to the existing ci.yml/fleet-converge.sh goldens. The self-referential drift fns are deleted; dag/test/claim/live_deploy/emit_test.dag now reads the real committed file via Filesystem.Read and byte-compares it against the emit fn, with a real (executed, not asserted) one-byte-perturbation RED control. Both frozen scripts carry a Scaffold disposition naming their Slice 3 dissolution trigger (heredoc→typed Filesystem.Write, apt/systemctl/tailscale→typed argv) — this is explicitly NOT a reshape of live_deploy's emission, only the freeze precondition for it.

Closes dashboard work item adhoc-655056b7-9c5.

Test plan

• claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/live_deploy/emit_test.dag --function live_deploy_emit_holds --wet — PASS (built locally via CTRL_BUILD_BYPASS_SHIMS=1 cargo build --release --bin claim_batch).
• Discriminating RED proven by execution: perturbed the real committed .github/live-deploy-srv1-apply.sh on disk by one byte, reran the same witness — FAIL (confirming the byte-identity check actually reads the file, not itself); restored the file, reran — PASS again; git diff showed no leftover changes.
• claim_batch --source-root dag --source-root src/v2 --entry dag/test/claim/generated_artifact_drift_test.dag --function generated_artifact_drift_witnesses --wet — PASS (registry completeness + commit-policy witnesses updated for the two new artifacts).
• CI note: main is currently red independent of this branch on doc_graph_has_no_orphan_docs (confirmed identical failure on main@45808d767b, which predates this branch and touches no files this PR changes) — a pre-existing main-inherited issue, not introduced here.