ci(vec-1): pin combined acceptance artifact source to 7d3bbf3d

[IchenDEV]

Summary

• Workflow-only re-pin of .github/workflows/manual-app-artifact.yml from the old VEC-4 feat: use a Xiaomi Bluetooth remote as a wireless microphone #104 head 31b3c7f614656c59855b7fd556734a11543fa9eb to the combined main head 7d3bbf3d45744c760714f955cf6c04a0f190904d (merge of VEC-3 fix: recover model downloads after a failed transfer #102 + VEC-5 fix: match System Settings surface colors #103 + VEC-4 feat: use a Xiaomi Bluetooth remote as a wireless microphone #104 + fix: harden remote microphone sessions #109).
• Three occurrences updated: concurrency group, APPROVED_COMMIT_SHA gate, and actions/checkout ref. Header comment now records that the pin is the combined main head.
• No product code, scripts, or SDLC documents are touched. The workflow stays workflow_dispatch-only with the approval_ack=HOLD/APPROVED gate, clean-tree/SHA proof, build+verify, archive+re-verify, and artifact upload unchanged. It does not create tags or releases.

Rationale

The manual acceptance-artifact workflow is hard-locked to a fixed SHA by design. After #102/#103/#104/#109 merged, the combined acceptance package must be built from 7d3bbf3d…; the old #104-locked package cannot stand in for it. This PR is the independent workflow-only adjustment covered by the already-approved build/upload authorization (no re-approval requested).

Verification

• ruby YAML parse of the workflow: OK.
• bash -n over all six embedded run blocks: OK.
• git diff --check: OK.
• bash scripts/sdlc-checks.sh: passed locally.
• PR CI (Contract & Tests, Release-style App Build, SDLC Gate) is the authority for merge.