fix(wake): #914 digest renderer — WAKE_AGENT-prefixed ack line + digest-class locator threading

(a) the embedded ack copy-run line (digest.sh -> ack.sh embed) now bakes an
    explicit WAKE_AGENT=<render-time-agent> prefix (scrubbed via _scrub_inline,
    shell-quoted via printf %q), so an env-less copy-run resolves to the
    correct per-agent namespace instead of silently falling back to 'default'.

(b) _locator_line now also recognizes the locator vocabulary detector.sh (A1)
    actually emits for a digest-class entry (kind/id/observed_hash/remote/path
    /branches, not repo/issue/sha/file), so a digest-class ORIENTATION pointer
    carries a usable (soft) locator instead of rendering empty. Display-only:
    _has_hard_locator and the ACTIONABLE-tier hard-locator FAIL-LOUD (exit 4)
    are unchanged.

RED-FIRST: new D5/D6 groups added to test-wake-digest-hmac.sh, verified RED
against unmodified digest.sh/ack.sh and GREEN after the fix (stash/pop
diffed). H1/H2 (openssl-dependent) are now individually SKIPped instead of
short-circuiting the whole file, so D1-D6 (including the new tests) still run
and pass when openssl is masked from PATH.

Touches only digest.sh + ack.sh + their test harness + the wake manifest
version bump; store.sh/detector.sh/reconcile.sh untouched (avoids collision
with the concurrent #908 work).

Closes #914
Part of #892

packages/mosaic/framework/tools/wake/manifest.txt

@@ -24,8 +24,19 @@
 #              alarm-target/HMAC-key install-validation. Also folds in the two W6
 #              monitor-integration observations (monitor-side ingested_ts
 #              staleness + beacon HMAC-verify at record).
+#   0.6.1  #914 digest.sh renderer fixes (live wake-pilot findings): (a) the
+#              embedded ack copy-run line now bakes an explicit
+#              WAKE_AGENT=<render-time-agent> prefix (shell-quoted) so an
+#              env-less copy-run resolves to the correct per-agent namespace
+#              instead of silently falling back to `default`; (b) the
+#              ORIENTATION locator renderer now also recognizes the locator
+#              vocabulary detector.sh (A1) actually emits for a digest-class
+#              entry (kind/id/observed_hash/remote/path), so a digest-class
+#              pointer carries a usable (soft) locator instead of rendering
+#              empty. Display-only: the ACTIONABLE-tier hard-locator FAIL-LOUD
+#              gate (_has_hard_locator, exit 4) is unchanged.
 component=wake
-version=0.6.0
+version=0.6.1
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version