fix: harden hosted candidate evidence chain

[0thernet]

Summary

• bind every candidate deployment to the same hosted target and its immediately current predecessor receipt
• reject completed-evidence replay when its before attestation does not equal the predecessor after attestation
• document candidate deployment versus final release identity accurately and record the completed npm trusted-publisher environment migration

Security boundary

The new checks fail before provider mutation or release-attestation reads on target drift, and before replay acceptance on chain drift. Existing protected receipt custody remains unchanged.

Validation

• bun test scripts/deploy-hosted-sync.test.ts: 27 passed
• bun test scripts/release-workflow.test.ts --isolate --max-concurrency=1: 18 passed
• focused ESLint: passed
• independent exact-diff review: no P0-P2 findings; combined focused suites 55 passed
• bun run check in an isolated exact-history clone of commit 9d9dcde (tree 6bafbf0cbd38cb0433519e116cfb4dd3c6477e0e): passed, including package and daemon lifecycle verification

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hra	Ready	Preview	Sep 6, 2026 5:43am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hra-app	Ignored		Sep 6, 2026 5:43am UTC