fix: bind recipe identity to certified artifact bytes (DGR-025)

Append +artifact.<sha256> to the llama.cpp runtime axis, computed from the
exact bytes read by attest_loaded_runtime, so a differently-built shared
object with copied lock values can no longer forge a certified runtime
identity. Node/tracker parsers require the suffix; new test proves a
byte-identical-lock but different-binary artifact produces a different
recipe fingerprint. Regenerates conformance vectors accordingly.

105 passed in tests/test_native_identity_emission.py,
tests/test_runtime_pin_identity.py, tests/test_runtime_recipe_identity.py.

tests/test_runtime_recipe_identity.py

@@ -21,6 +21,7 @@ from meshnet_node.runtime_recipe import (
     check_session_open,
     check_route,
     handshake_error,
+    tokenizer_identity,
 )
 from meshnet_tracker.capability import (
     POLICY_COMPAT,
@@ -49,6 +50,7 @@ from meshnet_tracker.recipe import (
 )
 
 VECTORS = Path(__file__).parent / "data" / "recipe_fingerprint_vectors.json"
+TOKENIZER = tokenizer_identity({"tokenizer.json": b'{"vocab":{"a":0}}\n'})
 
 
 def _digest(char: str) -> str:
@@ -62,10 +64,14 @@ def _recipe(**changes: object) -> RuntimeRecipe:
         "compute_dtype": "float32",
         "kv_dtype": "q8_0",
         "kv_layout": "paged-v1",
-        "tokenizer_revision": "0123456789abcdef",
+        "tokenizer_revision": TOKENIZER,
         "architecture_adapter": "llama/range-v1",
         "backend_id": "llama.cpp",
-        "runtime_version": "llama.cpp@" + "d" * 40 + "+patchstack." + "e" * 64,
+        "runtime_version": (
+            "llama.cpp@" + "d" * 40 + "+patchstack." + "e" * 64
+            + "+build." + "f" * 64
+            + "+artifact." + "a" * 64
+        ),
         "recipe_id": "example-gguf",
         "recipe_version": "1",
         "catalogue_version": "2026.07.1",
@@ -238,10 +244,17 @@ def test_committed_vectors_cover_a_whole_model_and_a_derivative_shard():
         ("compute_dtype", "float16"),
         ("kv_dtype", "float16"),
         ("kv_layout", "contiguous-v2"),
-        ("tokenizer_revision", "fedcba9876543210"),
+        (
+            "tokenizer_revision",
+            tokenizer_identity({"tokenizer.json": b'{"vocab":{"b":0}}\n'}),
+        ),
         ("architecture_adapter", "llama/range-v2"),
         ("backend_id", "other-backend"),
-        ("runtime_version", "llama.cpp@" + "c" * 40 + "+patchstack." + "b" * 64),
+        (
+            "runtime_version",
+            "llama.cpp@" + "c" * 40 + "+patchstack." + "b" * 64
+            + "+build." + "a" * 64 + "+artifact." + "c" * 64,
+        ),
         ("boundary_schema_version", 2),
         ("protocol_schema_version", 2),
     ],