feat: pin runtime identity to the exact llama.cpp patch stack (DGR-025)

Derive the recipe's runtime_version axis from the DGR-027 lock manifest
(exact upstream commit + ordered patch-stack byte digest) in new
meshnet_node.runtime_pin, failing closed on any lock/series/SHA256SUMS/
patch disagreement, and enforce pin discipline on runtime_version in both
the node and tracker identity implementations.

Also repair pre-existing backlog consistency: add missing DGR-022/DGR-027
completionNotes, regenerate the DGR-022/025/027 issue projections, and
relocate three pre-DGR legacy GLM issue files to issues/legacy/. Mark
DGR-025 passes=true with evidence at evidence/DGR-025/README.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/node/meshnet_node/runtime_recipe.py

@@ -374,6 +374,11 @@ class RuntimeRecipe:
     one in fp16, produce different logits from the same bytes. Keeping the axes
     apart is the entire safety property; see :data:`RECIPE_AXES`.
 
+    `tokenizer_revision` and `runtime_version` must be exact pins, never moving
+    references. For the native runtime the canonical `runtime_version` value —
+    committing to the exact upstream commit *and* the ordered patch stack — is
+    derived from the DGR-027 lock manifest by :mod:`meshnet_node.runtime_pin`.
+
     The three label fields are diagnosis only and are not digested.
     """
 
@@ -400,6 +405,7 @@ class RuntimeRecipe:
             else:
                 _require_text(value, f"recipe.{axis}")
         _require_pin(self.tokenizer_revision, "recipe.tokenizer_revision")
+        _require_pin(self.runtime_version, "recipe.runtime_version")
         _require_text(self.recipe_id, "recipe.recipe_id")
         _require_text(self.recipe_version, "recipe.recipe_version")
         _require_text(self.catalogue_version, "recipe.catalogue_version")