Implement Comic Manifest immutable dependency and asset references #92

Parent epic: #6

Summary

Implement Comic Manifest immutable dependency and asset references for Comic Manifest v1.

Ownership and dependencies

• Repositories: platform; codex reference semantics.
• Depends on: Implement strict Comic Manifest parsing and semantic validation #90.
• Plan position: 5 of 12.

Scope and deliverables

• Implement complete exact identities for contracts, tools, prompts, context and assets, preserving protected versus public reference rules.
• Verify expected artifact size/digest through explicit host-installed trusted resolvers; no ambient fetch or floating branch resolution.
• Bound reads and enforce resolver containment, classification and source-access boundaries.
• Reconcile asset/dependency relationships with the episode and panel task.

Acceptance criteria

• Verified immutable references resolve through offline fakes and preserve exact identities.
• Missing, floating, substituted, oversized or digest-mismatched artifacts fail closed.
• Denied/unconfigured sources are not read; untrusted URIs or paths cannot redirect installed readers.
• Private source metadata never leaks through public projections or diagnostics.

Implementation guardrails

Follow Constitution v1.0.0 at a9cc8a503aa30e17820edc62ac95f7cbe10e0564 and the boundaries in #6. Use public/synthetic fixtures only. Preserve released Prompt SDK v1, Context Package v1 and Context Builder v1 bytes. Add focused tests and documentation with implementation; the suite task consolidates rather than postpones testing. No implicit retrieval, permission renewal, direct Lore checkout, silent declassification, self-approval or canon promotion. Normative gaps belong in Codex. Orchestration, rendering, production trust onboarding and creative canon remain separately scoped. Creating this issue does not authorize implementation or publication.