[codex] close out clusterfuzzlite, local gates, and proof routes

[xiaojiou176]

Summary

• pin the ClusterFuzzLite lane to digest- and hash-locked inputs so run-fuzzers stops falling back to a source build
• tighten root governance for .clusterfuzzlite and keep the local default gates aligned with the hosted-first five-layer contract
• sharpen the public front door with explicit proof routes and a dedicated docs/public_proof.md map

Test Plan

• ~/.cache/movi-organizer/venv/default/bin/pytest -q tests/unit/test_clusterfuzzlite_contract.py
• COVERAGE_FILE=.runtime-cache/test/coverage/.coverage.local-manual ~/.cache/movi-organizer/venv/default/bin/pytest -q tests/unit/test_test_system_round2_audit.py -k 'local_fast_and_standard_prepush_align_with_ci_core_gates or prepush_gate_defaults_to_standard_mode'
• ~/.cache/movi-organizer/venv/default/bin/python tooling/scripts/render_docs.py --check
• GitHub Actions rerun on PR head for pre-commit, cflite-pr, and ci

Breaking Changes

None

Rollout / Risk

• Risk: Medium
• Main risk is governance drift if the local gate contract and docs truth routes fall out of sync again.
• Rollback: revert this PR branch before merge.

Observability

• No new production runtime surfaces.
• Public proof and gate expectations are now easier to audit from docs.