feat(prime): verify managed distributions

[rynfar]

Problem

Pylon could detect whether Prime Agent was runnable, but it could not distinguish stock/custom packages from Pylon builds or authenticate a Pylon build receipt. It could not safely advise that a newer signed preview or stable publication exists.

Working functionality

• Parse and bind the frozen PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 release, preview, and stable publication schemas from exact publication commit f4d9ef03b529faf2e07031c8b7cd703363316ae5 and tree b9a14b389aa64f54527008fb4d6119a7c57c2b58.
• Verify Sigstore bundles with TUF trust material, Rekor and CT thresholds, GitHub OIDC and workflow identity, signer/source digests, workflow bytes, SLSA run details, and exact subjects.
• Classify an installed package as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt.
• Authenticate private no-follow receipts and high-water state with package-root binding and replay rejection.
• Keep offline classification while ordering advisories only by signed sequence and build ID.
• Expose an optional provider-neutral distribution status and render it in web Settings.
• Document the trust model, state contract, platform behavior, and limitations.

Scope boundaries

This is a read-only verifier. It adds no install, download, mutation, switch, cleanup, or self-update action. It does not change Prime SDK or post-attach capability negotiation. ACP fallback is unchanged.

Verification

• Focused tests: 78 passed, 2 skipped across 7 files.
• The 2 skips are existing real Prime bridge proof tests whose PYLON_REAL_PRIME_AGENT_* artifacts are not configured.
• Deterministic synthetic tests cover schemas, provenance bindings, tampering, package classifications, receipt authentication, replay, offline behavior, same-SemVer sequence updates, platforms, contracts, and Settings labels.
• Production uses the real Sigstore verifier. A fail-closed real immutable fixture gate is ready, but cannot run until PR chore(upstream): adopt the 2026-08-15 T3 Code batch #42 publishes the first immutable artifact.
• Focused lint passed with 0 warnings and 0 errors.
• Contracts, server, web, and mobile typechecks passed after rebasing and refreshing dependencies with vp i.
• Diff check passed and the worktree is clean.

Evidence

No browser evidence yet. The only UI change is the optional Settings distribution label.

Model: GPT-5.6-sol
Harness: Prime Agent (RLM child agent)

Closes #193

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.5 KiB	−44 B (−0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+8 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.6 KiB	−52 B (−0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.2 KiB	57.1 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.5 KiB	−54 B (−0.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	−56 B (−0.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.1 KiB	58.0 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: a509639 · PR result: 6371c61 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.