ci: refreeze the admission.rs source pin after the reviewed parent-entity seam

CI 32593268260 on bf34dc1 failed one job -- "CockroachDB / secondary Docker
parity / runtime writer RBAC" -- with "reviewed runtime source manifest does
not match the frozen contract". Exactly one pin in the
expected_reviewed_source_manifest block of
deploy/cockroach/tests/runtime-role-grants.sh was stale:

  src/evidence_ledger/admission.rs
    8a04ac035a8f60a00fc2137b3bcbac062b766048898a4d513aab572260e1d842
 -> 08d73dee7c57e4fe395155c8fc06d5e889fdc812840aaa4dfdb970cb140dc6bf

The reviewed change is a30071f (W3-CHAIN), which built the parent-entity
derivation seam. Provenance was checked digest-by-digest rather than assumed:
the frozen pin is exactly admission.rs at a30071f^, and the new digest is
exactly admission.rs at a30071f, which equals the working tree. So a30071f is
precisely and solely the delta the pin was missing -- no unreviewed drift is
being swept in behind it.

Security posture is preserved, which is why this is a refreeze and not a
revert. The parent entity is no longer refused outright, but neither is it
accepted from the caller: it is DERIVED from the child locator's own
already-proven coordinates under the active package's entity recipe for the
declared parent kind, and a locator naming any other parent -- including one a
caller minted itself -- is refused with ParentEntityUnsupported. A
provider-instance locator naming a parent at all is still refused, since an
entity is a root. No self-asserted identity is admitted.

Root cause, so this cannot recur: a stale pin could only be discovered by a
~20-minute CI round trip, because nothing in the local pre-merge gate checked
the pins. Both gate paths (.fleet-recall/fleet/gate.sh and gate-batch.sh) now
run refreeze-source-pins.sh in REPORT mode as their first step, immediately
after the cherry-picks and before any cargo work, so a stale pin fails locally
in ~0.2s with the exact diff to review and the exact refreeze command. The
gate never passes --apply: the pin exists so that a human reads the
security-boundary diff, and auto-refreezing would defeat the whole mechanism.
refreeze-source-pins.sh grew a --root flag for this, since the gate runs from
the integration worktree, which carries no .fleet-recall/ of its own. That
harness lives under the gitignored .fleet-recall/, so it is not part of this
commit; only the digest literal is.

Verified: the gate wiring reproduces this exact CI failure locally in 0.18s,
and the full official lane (deploy/cockroach/tests/registry-activation-cli.sh)
passes against a live CockroachDB.

Claude-Session: https://claude.ai/code/session_01BxEBa1v242Fo1AJJGftFnZ

Author: scottmeyer

deploy/cockroach/tests/runtime-role-grants.sh

@@ -972,7 +972,7 @@ c885c07bce2caa310a2b9f1d8fd2aa49edc672c4184bb4b85a9e2018993f9cb1  $repo_root/src
 ee1d0b5a13f1906c13cbd3e93d26196d7bdace91895d8d2302c440d66ec8ef53  $repo_root/src/application.rs
 2bfc742926ef753ee90458a294bb59dbddf2afa2e9983484548f2fe0b7b77d26  $repo_root/src/reference_agent.rs
 eebc2a17a41b3caa9b6f751f6d3f28b658aa9670f3cfb21d1e00b91219ffada6  $repo_root/src/registry_witness/mod.rs
-8a04ac035a8f60a00fc2137b3bcbac062b766048898a4d513aab572260e1d842  $repo_root/src/evidence_ledger/admission.rs
+08d73dee7c57e4fe395155c8fc06d5e889fdc812840aaa4dfdb970cb140dc6bf  $repo_root/src/evidence_ledger/admission.rs
 e162ab08fc55a6ec4760bf4fceca6ab90645dea404d9c189a057dfc72d53bb4f  $repo_root/src/evidence_ledger/content_store.rs
 4afddafc55424f6cdab7f1b3779135ee0287f560d5f78ae76d055f0ea2fd1498  $repo_root/src/relation_projection/mod.rs
 8d77efb246e57764887a1f518d78f0ab0f39a456b3a804733bb0e5c0acf94066  $repo_root/src/relation_projection/cockroach.rs