Defer the freshness-heartbeat component pending its control

validate-binding fails on every branch in this repository, and will fail on main at its next run: the freshness-heartbeat component landed in the catalog on 2026-09-05, no control cites it, and it is recorded as neither exempt nor deferred. This adds the one row it is missing.

It belongs in deferred_catalog_components rather than the exempt list. Exempt is for a component carrying no principle, a convenience or a rendering step. This one is the delivery half of freshness: it resolves the scheduled tripwire's last verdict in the deploying pipeline so a page can serve it beside the claims it grades, which is the same published-claim-currency principle freshness is already deferred against. Two halves of one principle should be recorded the same way.

The row is appended after freshness, keeping the map's insertion order, and its reason follows the five siblings' shape: the owed control, what the component does, and why a deferral rather than an exemption.

Verified with PIPELINE_REPO pointed at a catalog clone, so invariants 3 and 4 actually run: just validate passes with 6 deferred, and fails with the documented error when the row is removed. just guard and just check green.

Closes #9 (closed).