Restore bound PHP setup after upstream archive replacement #400

The upstream builds release replaced both admitted PHP 8.3 archives on November 14. The pinned Ubuntu 24.04/26.04 assets 739209532/739711545 return 404 before dependent repository tests can start. SDK PHP #426, CLI #161 and central #401 have named pre-test failures; #403 is the same root cause.

Repair: PR404. General owns the common input repair; consumer owners retain their own source, acceptance and delivery decisions.

Completion requires:

• Bind each replacement official asset by exact ID, size and SHA-256, regenerate and independently review its complete archive/link/alternatives/configuration records, and pass ordinary checks. Preserve installer, TLS, regular-only derivation, runtime and credential boundaries. No mirror, fallback or broader profile.
• Qualify both original hosted setup profiles and admit the reviewed immutable helper through the existing action and workflow policies.
• Update affected consumers to that accepted revision and verify successful previously blocked original callers. Keep original failures as failures.
• Verify the existing drift check against the refreshed catalog and explain upstream replacement/retention limits. An immutable Git pin does not make upstream release assets undeletable; do not claim otherwise or add an unreviewed mirror.

The data review is accepted and both real archives pass sealed offline normalization/strict inspection. The first hosted setup installed successfully, but its local-action CI wiring was refused and is being replaced with an immutable source pin and explicit bindings. The enforced main-only policy runtime cannot admit its own successor CI bytes without an organization ruleset source transition; that exact transition and the final reviewed successor must be prepared before any administrator action. Current credentials lack admin:org; no scope expansion, rule relaxation or bypass has occurred.

Related: #297 and the re-pin policy recorded in closed #358.