Bootstrap immutable provenance signer before completing PR #2806

PR #2806 cannot safely define and pin its reusable provenance signer within one squash merge. The signer must first land at a dormant workflow path in a separate squash-merged pull request so the resulting commit on `main` can become the durable signer revision.

The bootstrap change must not alter current release callers. After it lands, PR #2806 can pin the new signer by the resulting full commit SHA, migrate verification, retire the old signer, and preserve squash-only merge policy.

## Acceptance Criteria

- [ ] A bootstrap PR adds the dormant immutable provenance signer and its focused contract tests without changing active release callers.
- [ ] The bootstrap PR documents that it must be squash merged before PR #2806 can receive its final signer SHA.
- [ ] Required hosted checks pass for the bootstrap PR.
- [ ] The resulting squash commit on `main` and signer workflow blob are recorded and verified.
- [ ] PR #2806 is refreshed from `main` and pins the new signer workflow to that exact squash commit.
- [ ] PR #2806 updates provenance and Marketplace verification to the new signer path and revision before retiring the old signer.
- [ ] Repository administrators complete the `release-governance` environment, Release App Administration-read permission, required tag rulesets, bypass evidence, and controlled release proof before release activation.

## Related

- Parent implementation: #2794
- Governance prerequisites: #2802
- Dependent pull request: #2806