Keep Workflow SDK-neutrality resource and docs projection digests independently verifiable

[rmcdaniel]

Problem

The SDK-neutrality authority lock identifies Workflow 2.0.0-rc.12, its source commit, and resources/sdk-neutrality-contract.json, but its sha256 now contains the digest of the docs-derived public projection. The named tagged Workflow resource hashes to 93ab20aa7c69a4994affef4b3d511c0bf99d2304828d9626615b2da3f60064fd; the projected docs contract hashes to d9cd2ee9af3dbf1ba45b5e81cc4b3478cd36fedb303bb173ace7b8154bd1fb1e.

The projection legitimately adds current Python distribution metadata, but reusing its digest as the Workflow manifest digest makes the lock and artifact handoff impossible to verify against the resource they name. It also removes the standalone proof that the base contract came from the exact tagged Workflow artifact.

Acceptance criteria

• Preserve an immutable digest for the exact tagged Workflow resource separately from the digest of the docs projection.
• Give both digests unambiguous versioned fields, and make artifact handoffs carry and verify both identities.
• Derive the public projection from the verified Workflow bytes plus the centralized published Python tuple.
• Fail independently when the Workflow ref, source commit, base-resource digest, projection digest, or Python tuple drifts.
• Keep the public contract linked to the exact current Python prerelease while the standalone Server continues to re-export the packaged base contract.
• Add regression coverage for an upstream base-contract change and for a Python-only published-version change.

Delete when

Delete when a consumer can verify the named Workflow resource and the derived docs projection independently through the lock and handoff, with drift in either identity rejected.

[rmcdaniel]

Completed in 3a885bd5acb5 on main.

Required public qualification passed: https://github.com/durable-workflow/durable-workflow.github.io/actions/runs/31303175653