test: gate the dev release manifest against the compiled contract set

Nothing in the gate set read `public/*.json`. Every static gate passed and the
whole suite passed while `pnpm dev` rendered the boot-error screen instead of
the app, which is the only reason the drift survived two contract changes.

`check:dev-release-manifest` compares the fixture's `setAlgorithm`, `setDigest`
and package set against what `generate-contract-set.ts` composes, and is
registered on FE-GATE-010 next to `check-tech-log-contract` so CI executes it.
Unlike the refresh wired into contract generation, this observes the composed
set directly, so it also catches a contribution added to or removed from
`installed-contract-contributions.ts`.

`CANONICAL_GATE_SHAPE_SHA256` recomputed by hand, as always: the committed
constant 98d19911... was first reproduced from the committed `gates.json` with
an independent transcription of `canonicalGateShapeSha256`, and only then was
b4096244... hashed from the new one. Command counts move 84/96 -> 85/97;
artifacts stay at 130 because the gate publishes no evidence file, matching
`check-tech-log-contract`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

config/ci/gates.json

@@ -333,6 +333,11 @@
       "script": "check:tech-log-contract",
       "expect": "pass"
     },
+    {
+      "id": "check-dev-release-manifest",
+      "script": "check:dev-release-manifest",
+      "expect": "pass"
+    },
     {
       "id": "build",
       "script": "build",
@@ -1972,6 +1977,7 @@
         "check-registries-fixture",
         "check-routes-fixture",
         "check-tech-log-contract",
+        "check-dev-release-manifest",
         "check-ci"
       ],
       "logArtifactId": "artifact-artifacts-quality-gates-FE-GATE-010-txt",