Freeze delivery capabilities as regression contracts; gate CI proofs

[bigboateng]

Boundary

This change pins the software-delivery accepted-transition boundary: the guarded path from flow source through the canonical artifact and its per-host projections, the selection relation, authority and freshness admission, journaled effects, and foreground-work suspension to a published delivery. These behaviors were load-bearing but only partially frozen as executable contracts, so a refactor could silently change what the runtime admits, selects, or refuses while still compiling and passing nearby tests.

Transition

Before, several invariants held only by implementation: an unselectable transition could in principle have been picked by untargeted resolution, targeted and untargeted resolution were not proven to derive the same prescription, forged repository authority was refused but nothing pinned that the refusal happens before any journal or effect activity, tampering with a generated Cursor or Gemini projection was rejected but untested, and the foreground-work loop's stale-answer rejection and exact-run resume had no contract at the delivery surface. In CI, the frontend-dependent conformance proofs - including the proof that repository-authored flow source is parsed, never executed - skipped silently on runners without the frontend installed. After, each of those behaviors is an explicit regression contract that fails the build if it drifts, and CI runs every frontend-dependent proof in required mode where skipping is an error.

Evidence

Five regression tests were added at their real boundaries: the kernel selection relation proves an explicit-only candidate is skipped untargeted, prescribable when requested, and unresolved when it is the only candidate; the engine's public resolve path proves targeted and untargeted resolution admit one identical prescription; a forged authority fingerprint is refused at resolve and apply with zero journal begins, zero effect executions, and zero receipts; the control-program artifact check binds all four canonical host projections byte-exactly and refuses a tampered projection or a narrowed projection selection as stale; and the delivery controller's Handle surface drives the full foreground-work loop - suspend, question, stale-answer refusal, answer binding, apply refusal while incomplete, completion, and resume bound to the originating request and committed result. The full package suite passes with -count=1 including the end-to-end product-delivery journey to its marked target; vet and build are clean; the frontend conformance proofs run 23 tests with zero skips in required mode; and the repository-contract suite (69 tests) accepts the edited workflow.

Commits

• Freeze delivery capabilities as regression contracts and gate frontend proofs in CI
• Seal converged self-review attestation

Self-review attestation

• reviewed tree: cdfe3ed9fd234a119274ac44f54583e993b2e073
• program fingerprint: 2277c979a06ee984c09aa32b2ed3d8886f1ae685a647274185a71a75a1a3961c
• the review-verified CI job re-derives both facts deterministically from the base-admitted policy