feat: ingest versioned deployment receipts

[ShuhaoZhangTony]

Summary

• consume the shared vllm-hust.deployment-receipt/v1 contract pinned from dev-hub main
• enforce hash/schema/source/freshness/public-value validation and active/superseded/failed lifecycle
• ground runtime identity, Support citations, health, and knowledge maintenance status in the latest fresh receipt
• automatically write a private receipt only after the canonical verifier passes health, dialogue, NPU, graph, and import-origin gates

Validation

• uv run ruff check src tests tools/write_verified_deployment_receipt.py
• bash -n tools/verify_sage_mate_engine.sh
• uv run pytest -q — 686 passed, 28 skipped
• focused receipt/runtime/deployment suite — 53 passed

Closes #11