[i2cjak]

Fixes the stale producer pin that fails test_workflow_pins_this_component_producer (test/tools/release_bootstrap_test.py:206) on main and blocks #951's small gate.

The whole change is one literal in release-bootstrap.yml: --producer-sha256 goes from 29ba0604… to 86722ad1…. There is no producer, runtime, Bend, law or CLI change.

Why the hash changed

• scripts/service-release.py became 86722ad1… in 2409055c91 ("release: bind 0.14.1 producer and package version metadata"), merged by Bind 0.14.1 metadata and require packaged Windows standard-user smoke #911 as 0752c0c7e7.
• That commit changes one line of the producer, VERSION = "0.14.0" to "0.14.1". This was intended: the same commit moves the 0.14.1 version across the workflows and release metadata.
• The commit updated the version strings in release-bootstrap.yml but not the hash, so the pin stayed at 29ba0604…, the v0.14.0 producer. The new hash is correct, and only the pin was left behind.
• v0.14.1 (e564f904eb) carries the same mismatch.

Why nothing caught it

• ci.yml is manual and nightly only, and that is where this test runs. It was not among the runs on Bind 0.14.1 metadata and require packaged Windows standard-user smoke #911.
• The release-bootstrap run on e564f904eb succeeded with its js and js-runtime jobs skipped, so service-runtime.py's hash check never ran.
• This is the third time a version or producer change has left this pin behind (869919ffb3, 72f7e5694b, 2409055c91). A future 0.14.2 bump will need a fresh pin, computed from that commit's actual producer.

release-runtime-recovery.yml:92 (ae60a25a…): left unchanged

• It is not stale for the same reason. It has never tracked main: the commits that added and edited it hold producer e06a9052….
• Its one successful run (41672224463) checked out frozen ref cfdfc67bbf (Bump release packaging to 0.14.0 (Alpha) #825, the 0.14.0 packaging merge), whose producer is exactly ae60a25a….
• Moving it to 86722ad1… would break that frozen ref and gain nothing.
• Limit: the literal only fits that ref. Against any other ref the workflow stops with Component producer hash mismatch, so it fails closed, and no test binds it. Recovering a later frozen commit needs that commit's own hash.

[i2cjak]

This PR alone still fails the guards on the 23 baseline Node failures (j20261104202152-1470266; the same 23 fail on pure main, j20261104202440-1495217). With #956 the combined tree 5a035a8b17 passes pin checks and scripts/local-small.py --guards-only (j20261104204946-1688241). This does not cover the Bend step.