fix(release): keep the manifest OS contract in reviewed key order

The host-packages packager emits manifest.json with canonically sorted
keys, so parsed evidence carries operatingSystem as {codename, id,
version}. Cloning that into the release manifest broke the contract
validator's JSON.stringify deep-equality against the policy's reviewed
{id, version, codename} order. Rebuild the object in policy key order,
require the exact evidence key set, and key-sort the test fixture the
way the packager does so the suite reproduces the drift.

Co-authored-by: Cursor <cursoragent@cursor.com>