ci: add hash-locked CompanyScope and Sentinel conformance

[dinakarjs]

Adds hash-locked conformance lanes for CompanyScope Incident Register and Sentinel while retaining the floating lanes for release drift detection. Lockfile changes trigger both workflows.

CompanyScope pins agent-manifest 0.12.0 and verifies it matches integration.yaml. Sentinel locks its runtime and conformance dependencies together, including urllib3 2.8.0 and PyJWT 2.15.1. Both fixed lanes install with pip --require-hashes and run the existing tests on Python 3.11, 3.12, and 3.13.

Validation:

• Generated both universal hash locks with uv pip compile --generate-hashes --universal --python-version 3.11.
• Installed each lock with hash verification in isolated environments on all three Python versions.
• CompanyScope: 8 tests passed per version; manifest version checks passed on all three.
• Sentinel: 17 tests passed per version.
• actionlint and git diff --check passed.

Closes #248.