Design signed release-head freshness and explicit gateway freeze reporting #157

Part of #89. Design follow-up to #106/#107 and Irzhy's F2 review of PR #132.

Owner: Anders (@andersalm). Task base and PR target: develop.

Runtime tells users when an explicit gateway's signed release head cannot establish freshness. A valid signature and an equal installed version alone do not establish that the publisher's latest release is visible.

Done means:

• Agree a signed head schema with expiry, clock handling, compatibility and publisher re-signing cadence, including publisher-key operations.
• Expired or unqualified heads report freshness unknown; the client distinguishes that state from a verified up-to-date result.
• Define the interim explicit-gateway message while the current schema remains supported.
• Cover replayed, expired, current, malformed and legacy heads with tests and a signed isolated fixture.
• Required checks and independent model reviews pass before merge (rule, 10 Oct, #89). Real publisher-key use remains separately approved operator work.