Enforce public-source release health

[msinclair25]

Outcome

Closes the post-M4 release-health gap: ordinary CI now scans complete reachable Git history, and public product documents accurately record that M1-M4 are merged and deployed to the persistent Community alpha without claiming named-client certification or human-only live acceptance.

The obsolete pre-squash public branch that triggered the scanner was removed after its complete history was preserved in a verified local bundle and all source content was confirmed present on main.

Scope and acceptance criteria

• Scope is focused and documented.
• Acceptance criteria are satisfied.
• Out-of-scope follow-ups are listed.

Live named-client exercises, destructive rollback, plugin marketplace submission, personal-vault testing, and managed-service expansion remain separate authorized/human gates.

Risk review

• Authentication, authorization, pairing, or sessions
• Cryptography, backup, or recovery
• YAOS/Yjs schema or protocol
• Durable Object identity, state, or migration
• D1 migration or R2 storage format
• Vault paths, .obsidian, Markdown, or attachments
• Deployment, bindings, secrets, or retention
• None of the above

Risk is limited to release workflow/history validation and status wording. No runtime, binding, secret, schema, or durable record changed. Full-history checkout intentionally makes ordinary CI enforce the existing release scanner.

Verification

• pnpm check
• Relevant tests
• pnpm build
• pnpm deploy:dry-run
• Success, failure, and authorization boundaries tested
• No secrets or personal vault data in the diff
• Documentation and migration notes updated

pnpm public-source:check passes locally across 32 revisions / 836 blobs and in a fresh all-branches GitHub clone across 32 revisions / 838 blobs. The prior exact M4 candidate and merged main completed the full test, browser, build, and deploy-dry-run gate; this follow-up changes only CI and documentation.

Screenshots or traces

Not applicable; no UI or runtime behavior changed.