Prevent resealing bundles loaded without integrity verification #1990

Follow-up to #1928. Prioritize preventing a reseal after an unverified load.

WorkflowBundle.load(verify_integrity=False) followed by save() can reseal a tampered bundle (ir.py, load/save paths). The current caller verifies first, so the review found no current exploit path, but the API permits a future caller to erase the failed or omitted verification step.

Make the state structural: an object loaded without integrity verification must not be saved as a verified/resealed artifact. Preserve the distinction between new authoring and loading existing bytes; do not let copying or schema upgrades silently grant verified provenance. Keep verification of original canonical bytes before migration and retain the frozen historical bundles.

Also address the related review notes: qualification_proposal.py still uses compute_content_digest; a stripped manifest is treated as an unsealed bundle; and authorization_summary.py skips integrity verification. Consumers that require a seal must refuse missing or unverified integrity, while any supported unsealed authoring remains explicit.

Acceptance: add regression coverage for tampered unchecked-load then save, copy/upgrade paths, missing manifests in seal-required consumers, and summaries/proposals from tampered input. Preserve valid historical load/save and digest behavior. No weakened seal, admission or downgrade checks.