fix(portable): qualify updated Classic login packet source #50

Problem

Parent atrinik/atrinik#562 still requires a portable client built from the corrected Classic login and notification implementation. The currently accepted portable producer contract names Classic 4998131ad2ae4c9680685fd87e2d85de1dc15fd9; that immutable image cannot qualify a different Classic source commit.

Classic issue atrinik/classic#550 and PR atrinik/classic#551 own the implementation fixes. Their actual merged source must be observed before this leaf changes the producer contract. Existing devcontainer #47 / PR #48 delivered the earlier source and remain completed.

Required implementation and ownership

• In atrinik/devcontainer, update portable/contract.json to the exact actually merged Classic source. Update shader/toolchain metadata only when those inputs actually change; preserve the existing compiler and platform baseline when unchanged.
• Use the existing portable Dockerfile and normal repository CI/publication contract. Preserve exact source checkout, shader/source provenance, immutable inputs, legal requirements and real consumer/payload validation.
• Deliver the necessary owner PR, independent whole-diff review and applicable final-head checks. The coordinator must not manually publish a release or bypass the maintainer's merge/publication gate.
• After approved normal publication, retain the actual immutable image index and platform manifests, producer source, Classic source, shader/toolchain metadata and successful consumer-validation/publication job coordinates for the dependent wrapper update.
• Keep the current optional supply-chain diagnostic policy. Catalog drift alone is not a blocker; immutable-input, provenance, license and payload verification still apply.

Dependencies and boundaries

Blocked on actual merge of atrinik/classic#550 / PR #551. Content is not a producer-image input; the separately approved atrinik/content#264 change remains a runtime integration dependency. No content/assets, development-container setup, execution authority, Windows behavior or unrelated toolchain changes are authorized here. No stacked publication assumption.

This is a separate physical-owner leaf of #562. A partial producer PR must not close the parent.

Acceptance

• Exact accepted Classic source and producer metadata agree, with no guard weakening or arbitrary commit substitution.
• Existing CPU-only real portable consumer validation and applicable image/source/provenance/legal checks pass at the final producer head.
• Fresh independent review and all applicable final-head checks pass.
• Required producer delivery is actually merged, and approved normal image publication succeeds; exact immutable image/platform digests and source identities are available for wrapper consumption.

Parent: atrinik/atrinik#562