release: refresh Bridge candidate for VobSub UAT

[ruizkinio]

Summary

• lock the coordinated candidate to Bridge commit a2716ae68e9ce88561ed0ebc9ec1092cd20c3535
• bind production digest and protected deployment artifacts from run 31727797491
• update the audited Bridge package manifest hash and release status

Validation

• npm test: 52/52 passed
• npm run validate:release: metadata and public proofs passed
• npm run validate:release -- --require-ready: all non-physical proofs passed; expected blockers remain physical UAT and generated security audit
• isolated UAT live VobSub smoke passed against exact merged SHA