Phase 6: immutable audited 31-payload candidate

[acedward]

Outcome

Implements the fail-closed Phase-6 candidate pipeline for exactly 31 destination payloads (10 software + Q8=B's 21 noarch proof payloads), plus exactly 21 typed content-evidence assets and two frozen promotion-envelope transport assets. Compact payload count is zero.

Supply-chain boundary

• pins all eight retained audited inputs by repository/run/event/conclusion/full source SHA/artifact ID/name/size/wrapper SHA-256/expiry
• requires protected-main ancestry and exact build-set SHA-256
• uses hosted read-only assembly and a fresh non-executing streaming verifier
• serializes all publication globally and restricts draft/publisher jobs to candidate-publish
• cryptographically verifies the Sigstore bundle before create-only release upload
• independently reads back every byte, publishes immutable, and requires a no-op metadata mutation to be rejected
• runs post-completion read-only live verification so run success evidence is truthful
• contains no destination credential and performs no warehouse write

BREAKING policy/schema change

build-set-v1 now requires exact inputArtifacts and payload byte/source/container/mode fields. The validator also corrects legacy existing coverage semantics: an exact warehouse snapshot asset may complete a reviewed family/version without fabricating a new target component, while the family naming contract, snapshot identity and exact asset bytes remain mandatory. The warehouse component-policy digest pin must be updated in its companion PR before Phase 7. Promotion-envelope-v1 wire fields and roles are unchanged.

Verification before push

• Docker: catalog + workflow policy + generated build-set closure + full source ancestry + 63 tests PASS, one documented missing-native-tools skip, zero failures
• actionlint 1.7.12: all three Phase-6 workflows PASS
• Python compile, JSON parse, git diff --check: PASS

No release, tag, draft, destination asset, or live demo was changed. Do not merge or dispatch the publisher until the pinned independent supply-chain audit returns PASS/0.