fix: enforce custom artifacts and VM runtime gate

[tifycloud]

Summary

• fail closed when custom build manifest generation or auditing fails
• audit complete custom artifacts before upload, including hidden files
• run the VM production runtime gate as a procd-managed worker
• fail QEMU validation immediately on explicit runtime gate failures
• add regression tests for both real cloud failures

Verification

• ./tests/test_static.sh
• actionlint
• shellcheck
• independent review: PASS, no P0/P1

Cloud incidents fixed

• custom build run 29791127025 silently omitted custom-build-manifest.json
• VM RC.5 run 29791156623 timed out without production runtime evidence