fix(managed): ship cross-process receipt export runtime

[TeoSlayer]

What changed

• consume github.com/pilot-protocol/common@v0.5.13, which makes the daemon discover receipts appended by separate hook processes
• allow the attested release workflow to publish managed-runtime-v* authority-pinned builds
• keep managed builds from replacing the ordinary vX.Y.Z GitHub latest release
• repair the undefined CodeQL matrix input and pin CodeQL v4.37.4
• quote nested canary-dispatch form keys and make every workflow pass actionlint

Production failure

The Gemini hook correctly blocked the prohibited shell action and wrote a signed local receipt. The hosted traffic exchange captured the decision and terminal result, but the Evidence link returned no matching object because the daemon exporter had opened the journal before the hook process appended to it.

Validation

• go test -count=1 ./... (including the 286s full tests package)
• go test -race -count=3 ./cmd/daemon ./cmd/pilotctl ./internal/enterprisecontrol
• go vet ./...
• govulncheck ./... (0 reachable/package vulnerabilities)
• go mod verify
• actionlint (all workflows)