Packaged Grok qualifier copied signed Git and stripped host lineage

[sumitake]

Summary

The provider-free packaged Grok release qualifier had two caller-side reliability defects while exercising the staged 7.0.1 package:

1. It copied the already-qualified canonical macOS Git bytes into a private PATH. macOS terminated the copied platform binary with signal 9, so repository sealing returned a typed invalid request before the fake carrier ran.
2. After switching to the canonical executable, the closed child environment stripped all host observations. The coordinator therefore projected null author lineage and returned selection_contract_mismatch before a carrier process.

No provider model call was made in either failure, and neither request was replayed.

Corrective boundary

Workspace PR https://github.com/sumitake/agent-collab-workspace/pull/3112:

• uses an exact verified link to the already-qualified canonical Git binary and revalidates its lexical target, resolved target, inode identity, and digest before and after execution;
• supplies one deterministic private test session so the co-packaged coordinator retains ownership of distinct-family routing policy without inspecting ambient host metadata;
• removes the timing-sensitive carrier trace side channel;
• treats unknown/additive diagnostics, implementation fingerprints, and descriptor-valid artifact content as non-authoritative;
• gates only on the signed receipt, exact source/carrier identity, one bounded process/invocation, verified in-root reads, terminal closure, unchanged package/source, and cleanup.

Three independent provider-free staged-package runs now close with identical runtime and fixture identities, one process/invocation, both reads verified, no outside source, unchanged inputs, and cleanup confirmed.

Release state

The public 7.0.1 release remains unpublished and unactivated. This issue should close only after PR #3112 merges normally and its merged qualifier re-confirms the staged package.