Migrate supply-chain witness production to emit (install-side-effect emitter); re-enable package_inspection

[TSavo]

Context

Surfaced by the 2026-05-25 architecture ground-truth audit (docs/audits/2026-05-25-architecture-ground-truth.md). This is the one genuine work item the lower->emit retirement (#1476) left behind.

Problem

provekit mint on the supply-chain-rails authenticated-betrayal packages fails:

error: kit transform failed: ORP witness failed: package.no-install-side-effect

Root cause (audit, grep-confirmed): the package.no-install-side-effect witness is still produced by supply-chain-js-lowerer.rs (a lower-era kit). lower was retired in #1476, and no emit witness emitter for the install-side-effect surface exists anywhere in the repo, so mint's emit_witnesses -> cmd_emit::emit_witness_requirement cannot discharge the obligation. The supply-chain package also has no .provekit/emit/* manifest.

What to do

1. Write an emit witness emitter for the install-side-effect surface (the no-install-side-effect obligation), registered via a .provekit/emit/<surface>/manifest.toml in the supply-chain package, replacing the js-lowerer witness path.
2. Re-enable package_inspection_contract_set_matches_lifted_mint_contract_set (currently #[ignore]d in menagerie/supply-chain-rails/tests/smoke.rs).
3. Fold this into the broader supply-chain-rails + bridgeworks "redo-on-emit-or-retire" demo decision (those demos' lower-era tests are also quarantined; orphaned .provekit/lower/** manifests remain to be cleaned).

Not a live-path regression

The emit-witness infrastructure itself is healthy; this is purely a missing emit emitter for a witness that was only ever lower-produced.