[dnlrsls]

Summary

Ship v0.1.0 as the offline auditor MVP: audit, report, conditional bootstrap --dry-run. Related to #9: executable lint verification stays experimental/unvalidated and deferred; no issue closure, ESLint success or project enforcement claim.

The maintainer explicitly selected actual native-CI artifact distribution, replacing local cross-build reconstruction. The failed local compiler/profile attempt is preserved and is not release proof.

• README, release notes and third-party notices state the narrowed scope and unsigned-binary limits.
• Existing native Go tests build and exercise the versioned CLI, then ZIP those exact tested bytes with licenses and source/run/attempt metadata. The existing Go workflow retains only that output after tests and vet succeed, using the already reviewed upload-artifact pin.
• No production CLI/API/schema/guard/dependency changes, Node/Docker execution, new release workflow/framework, force push or branch deletion. The original 1.26.x Go CI contract remains intact; each archive records the actual compiler.

Review surface

Two coherent commits: initial documentation/license/version check (278 authored lines) and native retention/export (238 authored lines), plus 412 lines copied verbatim from upstream license texts. The combined review is larger than the usual ~400-line target but remains one release capability; most new logic is test-only artifact retention. No private .git/ evidence, task cards, caches, old cross-build binaries or helper scripts are published.

Checks observed before this update

• Genuine RED: owned Go test succeeded but no native ZIP was retained (exit 1).
• GREEN: native ZIP binary hash/mode, allowed members, original license bytes and archive receipt (exit 0, empty stderr).
• Full offline Go tests and separate vet (exit 0, empty stderr).
• Source/dependency/fixture preservation; LICENSES LF checkout rule prevents the earlier export CRLF mismatch.
• Updated exact-source PR Go CI and new-main native CI: pending at this update.
• Actual final-main archive download/source/log/hash checks, final assets and release publication: subsequent steps, not claimed complete.

The native --version/help/audit/report/bootstrap/cold-verify/argument-refusal and unchanged input/counter checks run before retention. No reconstructed local binary is eligible for release. Risk: item 5 (distribution/CI/publication). RDD is off; native unknown/unassessable is not approval. Independent verification of the new unit is required before this update is published.