release-prooflisted

# Release Proof Treat release as a two-seal transaction. Never publish from a source checkout merely because its tests pass. Never turn `UNKNOWN`, `SKIP`, `todo`, `0 tests`, dirty state, or an agent report into green. ## Non-bypassable rules 1. Use the exact source SHA and one packed-artifact SHA-256 everywhere. 2. Require zero open GitHub issues labeled `release-blocker`. Unlabeled backlog is not release authority; a local fix does not clear a labeled blocker. 3. Run CI, integration, UX, and stranger qualification once in `.github/workflows/release-candidate-preflight.yml` on `release/**`. Require its exact-SHA, source-bound package and aggregate before that unchanged SHA reaches `main`. 4. Reject any test/QE result with zero tests, skips, todos, unknowns, pending jobs, or failures. 5. When the candidate changes architecture or the retrieval oracle, require the accepted Fable 5 and GPT-5.6-Sol design-review receipts for that change. Routine releases do not manufacture caller-supplied reviewer keys; bundled public keys are integrity material, not an independent trust anchor. 6. Install the sealed artifact into virgin Claude Code and Codex homes; test their real entrypoints. 7. Require the source package, Claude manifest, Codex manifest, packed npm version, bundle `brainVersion`/`releaseTag`, and both installed host versions to identify one exact generation. 8. Require the active Brain registry to contain the `ruvnet-brain` RVF store and require narrow, broad, a