Prepare alpha.4 AC-014 verifier handoff

[regenrek]

What changed

• add a repository-owned, live-monitored AC-014 fresh-arm runner with immutable result artifacts
• hard-cut maker batching at the typed source-freeze/verifier boundary
• bind verification settlement and final review to exact-source trusted receipt lineage
• add alpha.4 metadata, release notes, Fix13/Fix14 history, and deterministic regression coverage

Why

Fix14 narrowly exceeded the unchanged wall ceiling after stale copied paths and a verification outcome was leased to the maker. This change makes relocation and Evidence preflight explicit, gives verification a distinct sealed lease, and measures the one-shot arm from an exact candidate SHA.

Validation

• full Rust suite reached 676 passing tests plus 88/89 E2E before the ownership guard identified flow.rs hub growth
• ownership repair independently reviewed; exact boundary test, typed handoff E2E, and all 14 FeatureRun Evidence tests pass
• AC-014 runner, verification runner, release script, release-eval gate, docs reference, package dry-run, and proof drift checks pass
• independent Planr repair/re-review chain accepted

Remaining gated work

Remote Linux CI must produce fresh x86_64 and arm64 portability receipts for commit f14bfd2 before the one-shot AC-014 verification begins. Release publication remains blocked on a passing benchmark, release evaluation, exact-candidate approval, and post-publish smoke checks.