Harden top-level verification and CI

[midiakiasat]

Summary

Hardens VERIFRAX’s top-level verification, integrity, release and CI surfaces.

Changes

• Replaces placeholder and fail-open CI gates with executable checks.
• Removes workflows that fabricated successful legacy commit statuses.
• Pins GitHub Actions to immutable commit SHAs.
• Hardens finality, freeze, reproducibility, release and spec-publication workflows.
• Prevents force-moving release tags and destructive release recreation.
• Produces deterministic release source archives.
• Fixes the malformed engine/originseal.sh output path and shell syntax.
• Makes surface_path a functional GitHub Action input.
• Makes the action independent of the caller’s working directory.
• Adds valid evaluation fixtures and surface-only action coverage.
• Replaces the ineffective conformance comparison with real expected-versus-actual validation.
• Adds a versioned conformance-runner correction record.
• Reconciles the truth index against trusted repository content.
• Removes stale generated Rust build artifacts from the integrity manifest.
• Adds a PNPM workspace definition and synchronises package lock versions.
• Makes build:ci fail closed.
• Adds repository-hygiene and truth-index verification scripts.

Root causes

The repository contained placeholder gates, manually published success statuses, fail-open shell constructs, an unused action input, caller-CWD-dependent file resolution, stale integrity hashes and a conformance runner that compared expected output with itself.

Validation

• Full super audit: 0 failures
• Frozen PNPM installation
• Strict build
• Root tests
• Root lint
• Root CI
• JSON, YAML, shell, JavaScript and Python syntax checks
• Workflow hygiene across 32 workflows
• Truth index: 42 hashes across 10 frozen surfaces
• Conformance suites pass
• Tampered expected conformance output is rejected
• Surface-only GitHub Action execution succeeds from a foreign working directory
• Frozen tree remains unmodified