feat: make Phase 0 contract truthful and executable

[bitgorust]

What changed

Implements the repository-owned portion of roadmap Phase 0 through approved,
spec-anchored work:

• archives deterministic contract-link and renderer dependency-remediation packets;
• adds the journey corpus, consent protocol, and a strict validator that cannot turn missing
  participant runs into passes;
• publishes machine-validated support, security, privacy, vulnerability-response,
  redistribution, dependency, and release policies with dated evidence;
• verifies GitHub private vulnerability reporting through provider readback;
• inventories retained redistributable binaries and closes deployment staging/configuration
  secret-scan gaps; and
• implements the approved public-preview-release-gate: public preview is unsupported and
  uncertified, OUT-02/OUT-03 and the full platform matrix remain visibly incomplete, and every
  security/package/trusted-publishing/integrity/signature/provenance gate still fails closed.

The coordinated public preview is published as v0.14.4. Tag/version agreement is enforced
before publish, and the workflow retains exact release evidence even if a later step fails.

Current truthful state

• OUT-02/OUT-03 have zero eligible participants. Kimi/model probes are diagnostics only and
  never enter the participant denominator.
• There are zero fully supported platform/browser cells. Public preview makes no support,
  usability, parity, accessibility, performance, operational, or production-readiness claim.
• Exact-tag tests, build, structural checks, package review, audit, license disposition,
  redistribution inventory, secret/CSP controls, and private vulnerability intake pass.
• The exact packed and registry tarballs are byte-for-byte identical: 43 files, 50,698 bytes,
  SHA-256
  7a529bb0cb5cc2460be7df4183315186bf7034dc1284f496448584f2e020de1e.
• Authenticated npm readback verifies the exact bitgorust/opencode-artifacts / publish.yml
  trusted publisher with createPackage; registry signature and SLSA provenance bind tag
  v0.14.4, commit a5ee65a, workflow publish.yml, and run 31961711046.
• npm latest is 0.14.4, and GitHub reports the repository visibility as public.

Verification

• npm test — 130/130 pass under Node 24.19.0
• npm run build — pass
• npm run check — 35/35 registered invariants
• npm run check:licenses — 217 package entries pass exact dispositions
• npm audit --package-lock-only --json — zero findings at every severity
• npm audit signatures — 212 registry signatures and 22 attestations verified
• public-preview-release-gate archive validation — pass and archived
• journey-corpus-and-baseline archive validation — pass and archived
• platform-security-privacy-policy archive validation — pass and archived
• npm pack --dry-run — 43 intended files
• exact final branch CI run 31962091154 for 87c8c96 — pass
• clean registry install/render of opencode-artifacts@0.14.4 — pass

Publish workflow recovery

The tag workflow published successfully but ended red because npm 11 returned dist --json
as a singleton array and the verifier at the tag accepted only the equivalent object form.
The retained response already contained matching bytes, a package signature, and provenance.
Follow-up b97a9b2 adds the array form with a regression test; the corrected verifier passes
the retained response, and an independent registry download is byte-identical. The failure is
kept visible in the release record rather than rewritten as a green workflow.

Phase 0 and Goal 1 are complete for unsupported public preview. OUT-02/OUT-03 and the full
support matrix remain future certification gates, not preview blockers.