Govern real CTA QR asset

[leether]

Summary

• Re-copy and verify the real CTA QR asset from leether/md2wechat:assets/qr.png; the local asset already matched byte-for-byte, so no binary diff is included.
• Add verifiable CTA registry metadata: media SHA256, source provenance, actual image format, and dimensions.
• Add scripts/verify_cta_resources.py and run it in CI so QR registry drift is caught.
• Update asset governance docs and add a task card for the QR handoff.

Privacy boundary

• The QR decoded payload is not written into repository text.
• Registry keeps only public platform semantics (wechat://group) and file/source fingerprints.

Validation

• git diff --no-index --quiet ../md2wechat/assets/qr.png assets/qr.png
• .venv/bin/python scripts/verify_cta_resources.py
• .venv/bin/python -m py_compile $(git ls-files "*.py") scripts/verify_cta_resources.py
• .venv/bin/python scripts/smoke_imports.py
• git diff --check
• Privacy scan over changed files for absolute local paths, token/private-key patterns, and WeChat payload-like URLs