Restore exact repository inputs in protected ABI checks

[brandonpayton]

Why

Protected ABI checks inspect a pull request without executing its code.
The developer SDK product now includes musl license data, but those jobs
check out the candidate without submodules. They therefore fail before
deriving requirements because libc/musl/COPYRIGHT is absent.

This blocks ABI validation and the protected ready-to-ship gate for PR
#1253 and any later change that selects the developer SDK product, even
when the candidate itself is valid.

What changed

• Read the exact musl gitlink commit from the inert candidate tree.
• Fetch that commit without credentials from the fixed repository URL in
  the protected checkout.
• Apply the same materialization before the collector, request feed, and
  ready-to-ship merge-gate derivations.
• Add mutation-tested workflow contracts for omission, ordering, and
  candidate-controlled transport.
• Refresh the unchanged version-10 request-policy implementation digest.

Validation

• Full ABI request-feed shell suite, including 23 focused Rust tests.
• Protected PR-check, request-feed, and merge-gate mutation contracts.
• Merge-candidate workflow contracts and YAML parsing.
• Production-shaped no-submodule clone using PR Restore lightweight lazy shell and browser npm installs #1253 exact head:
  musl commit 0784374d561435f7c787a555aeab8ede699ed298,
  6,204-byte COPYRIGHT, and a clean parent checkout afterward.
• Generated request-policy check and git diff --check.

No runtime, ABI layout, package artifact, or browser behavior changes.

[brandonpayton]

Superseded by #1254. That PR now covers all three protected consumers (PR projection, request derivation, and merge-gate revalidation) through one credential-stripped, adversarially tested helper and request-policy version 11. Closing this duplicate so the two policy projections cannot race.