Seed protocol: declare draw_condition for zero-target humanitarian sites

Split from #767 / #779 review (Sep 4).

The thirteen immigration_humanitarian_*_assignment sites in spec_engine/seeds.py use the default draw_condition="always", but the kernel skips a category whose cited target is zero (if draw.target <= 0: continue in _assign_humanitarian_statuses) — so the deportation_withheld site (explicit cited zero) declares a draw it never consumes. The existing TANF/EITC sites show the precedent for a conditional declaration (only_for_missing_or_legacy_constant_output_cells).

Fix: declare the humanitarian sites with something like draw_condition="only_when_cited_target_positive". This changes the seed-protocol digest, so bundle it with the next change that already moves the attested identities (envelope digests, seed protocol/map digests, coverage evidence) rather than paying the re-pin cascade for a label alone. Purely a protocol-honesty fix; no behavioral change.

Start in spec_engine/seeds.py and inspect the thirteen immigration_humanitarian_*_assignment sites, then compare the TANF/EITC sites' conditional declaration. Check how _assign_humanitarian_statuses handles zero targets and verify the protocol digest and attested identity updates are bundled with the next planned change without altering behavior.