e2e(pi): qualification receipts are not anchored to the exact main candidate

## Investigation Summary

- [Pi AMD64](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977/job/100568885352) and [Pi ARM64](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977/job/100568885422) fail exact-candidate receipt validation on `3076188279c0ea657ec77aeeabebf1f82061eaaf`.
- The same parity failure repeats on `eb3fa2e5097389d7dd8e2643552788ff16d8f14a`: [AMD64](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943/job/100678907956), [ARM64](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943/job/100678908497).
- Both checked-in receipts point to source revision `49b70f08...`, from an off-main PR cohort rather than an ancestor of either candidate.
- The protected-input difference includes `nemoclaw-blueprint/blueprint.yaml`.
- The receipts were refreshed in [PR #10866](https://github.com/NVIDIA/NemoClaw/pull/10866).

## Description

The checked-in Pi qualification receipts certify a source tree that is not the exact main candidate, so both architecture gates fail before managed-runtime qualification.

Expected: qualification receipts are generated from and cryptographically tied to the exact protected inputs merged to main.

Actual: an off-main receipt cohort was committed, making strict parity deterministically fail.

## Reproduction Steps

1. Check out either candidate SHA.
2. Run the Pi AMD64 or ARM64 qualification target.
3. Observe the protected-input `git diff --quiet` validation fail against receipt revision `49b70f08...`.

## Environment

- GitHub Actions Docker
- Linux AMD64 and ARM64
- Runs: [33730208977](https://github.com/NVIDIA/NemoClaw/actions/runs/33730208977), [33761515943](https://github.com/NVIDIA/NemoClaw/actions/runs/33761515943)

## Acceptance Criteria

- Regenerate both receipts from the exact main candidate and protected-input tree.
- CI rejects receipts produced from non-ancestor/off-main source revisions before merge.
- AMD64 and ARM64 Pi qualification targets pass together.

## Latest Evidence

- [Pi AMD64 in exact-candidate run 33915961523](https://github.com/NVIDIA/NemoClaw/actions/runs/33915961523/job/101163750588) did not reach this receipt assertion. It failed earlier because the fixture supplied both inline and path-based managed-image catalog authorities; that earlier failure is tracked in #11083.
- Pi ARM64 did not execute in that run.
- #10966 therefore remains unverified, not reproduced, on candidate `0ddc3ea52`.
- PR #10996 contains a candidate cleanup for #11083, but it does not replace the required exact-candidate receipt evidence for this issue.