feat(fingerprint): ingest 2.1.109 candidate+verified manifests and support raw cli.js input

Adds 2.1.109 manifests to the fingerprint index alongside existing 2.1.111
coverage, promotes 2.1.109 as the latest verified version, and extends the
build-candidate-manifest script to accept a raw cli.js path so tracker
automation can extract fingerprints without a pre-parsed artifact.

Manifests
- manifests/candidate/claude-code/2.1.109.json (253 LOC, first-party captures
  of transport, headers, betas, billing, body, prompt, metadata, with
  parser warnings and unknown-field audit trail).
- manifests/verified/claude-code/2.1.109.json (110 LOC, promotedFields +
  rejectedCandidateFields from the trusted local verification pass).
- manifests/verified/claude-code/index.json: bumps latest to 2.1.109,
  records the version row.

Scripts
- build-candidate-manifest now sniffs raw cli.js input, runs the extraction
  pipeline, and writes the candidate manifest without requiring a
  pre-computed JSON. Integration test pins the contract.

Tests
- tests/integration/scripts/fingerprint-manifest-scripts.test.ts: new test
  for raw cli.js input path with CLIENT_ID/UA/SDK/BETA inline fixtures.
- tests/unit/request/profile-resolver.test.ts: refined to assert low-risk
  manifest values flow through while sensitive candidate headers stay
  blocked. Renames the test to reflect the classification.

8/8 scoped tests pass.