Fix verify-resource workflow source binding #2146

Defect

--verify-resource hashes installed workflow source bytes without normalizing the trusted installer-added terminal source: frontmatter binding, so a clean GH-AW consumer install fails verification.

Acceptance criteria

• Reuse the fail-closed workflow source-binding canonicalization used by full install verification.
• Validate exactly one allowed terminal binding against installed revision/provenance.
• Preserve exact-byte verification for shared runtime and skills.
• Cover clean installs and owner/repo/workflow/revision/suffix/missing/duplicate/misplaced/content mutations through the exported CLI path.
• Regenerate direct workflow package artifacts and pass GH-AW integrity, compile, test, lint, and build gates.