Decide: adopt the tar audit (#1) and verified bar v2 (#2) #11

#1 and #2 change what the org promises in public, so they need a person's decision, not only green CI. A Claude session wrote both. Adversarial reviews by other agents fed into each, but no person has reviewed either yet.

• Audit the tar pilot against the verified bar; correct its status #1, the tar audit. The org's first review record. It finds the tar pilot built but not verified: the main theorem states less than the public claim, and three of the six bar items are not fully met (findings F1 to F6). It changes "Pilot (complete)" to "built, not yet verified" in the README and on the website.
• Verified bar v2: pin reviewed statements and claims, check by machine #2, verified bar v2 (stacked on Audit the tar pilot against the verified bar; correct its status #1). The bar becomes seven items. bar/check.py checks each item a machine can, in a reusable workflow that library repos call. It adds bar/reviewers.toml, the list of spec reviewers, which is empty for now (Decide: name the first spec reviewers #8). The website lists the seven items.

What waits on this

• tar#6 and codec#1 run the checker from Verified bar v2: pin reviewed statements and claims, check by machine #2's commit 6ba85c2. If Verified bar v2: pin reviewed statements and claims, check by machine #2 changes, their pins move with it.
• Naming spec reviewers (Decide: name the first spec reviewers #8) and protecting main (Decide: protect main branches and require the bar check #10) both assume Verified bar v2: pin reviewed statements and claims, check by machine #2.
• Until Audit the tar pilot against the verified bar; correct its status #1 merges, main and the website still call the pilot complete.

Options

1. Merge Audit the tar pilot against the verified bar; correct its status #1, then Verified bar v2: pin reviewed statements and claims, check by machine #2. Then tag a release for libraries to pin (Decide: protect main branches and require the bar check #10).
2. Ask for changes to either PR.
3. Keep bar v1: merge Audit the tar pilot against the verified bar; correct its status #1 and close Verified bar v2: pin reviewed statements and claims, check by machine #2. tar#6 and codec#1 then need rework, since they are built to v2.

Completed by merged pull request #2.