Fix frozen v1 session-bound token schema

[chen21019]

Root cause

The live token authorization overlay exposed clientSessionId, but the frozen v1 base, superadmin, and token schema snapshots did not. /v1/token therefore silently dropped the generation and created a legacy unbound token. The integrated Server runtime gate caught this when a mismatched delete revoked the newly-created token.

Changes

• publish the fixed-format sensitive create-only field in all frozen v1 token schemas
• add a deserialization regression test covering every frozen schema that exposes token
• add a bounded, idempotent maintainer utility for snapshot regeneration
• enforce the contract in source and packaged-artifact gates
• bump the immutable Engine release to 0.183.308 and document v1/v2 consumer acceptance

Verification

• FrozenTokenSessionSchemaTest: 1 passed
• TokenResourceManagerTest: 5 passed
• scripts/check-pasturestack-source: PASS with auth_token_frozen_v1_schema=base-superadmin-token
• maintainer tool second run: patched=0 verified=3

Server publication remains blocked until both /v1/token and /v2-beta/token pass mismatched/matching/idempotent delete checks in the real candidate runtime.