Pin v0.1.3 release preparation artifacts

[AMBRA7592]

Summary

• pin the accepted v0.1.3 Database A/B, import SQL, release ZIP, package-manifest, and preparation-packet hashes
• make the production procedure verify and consume the fixed SQL/ZIP instead of rebuilding them during the window
• pin one exact v0.1.2 predecessor / v0.1.3 successor pair for coexistence and live-byte verification
• strengthen the independent SQL guard with a three-target INSERT allowlist and rejection of UPDATE, ALTER, setval, and ON CONFLICT
• preserve the historical v0.1.2 procedure unchanged
• mark the preparation packet as private operator/auditor evidence, not a public release asset

Preparation evidence

• Database A: bb7fea78d25028b83bc9cf3dfe6de6cbbbffe3f5d0c8a2ab315bfd63dd6cea83
• deterministic additive SQL: cbc40527da1840632452d762c92587a00783268a0db4e89e1aa4e5e961b05c77
• fixed release ZIP: 501f3c544b251b19316e4473c03fc1ac9ba8ef3fb8a55873b0a11ab597b048e4
• secret-free audit-packet manifest: 25e63fbef5afa80a95443d372c293c7837b3b814885ac9050e3ee387fa71ca2c

The two SQL exports were generated from Database A under PYTHONHASHSEED=0 and 4242; they are byte-identical, contain only the three expected INSERT targets, and contain no destructive statement or activation call. Two independent git archive builds from bad85f8:event_class_records_v0.1.3 are byte-identical. The extracted ZIP matches the frozen repository package and passes its manifest, package validator, and offline verifier.

Scope

Repository diff: RELEASING.md only. All frozen package trees and implementation-hashed sources are unchanged.

No tag, Neon/Vercel access, deployment, activation, GitHub Release, Zenodo change, or frozen-package modification was performed.

Verification

• 95 passed, 2 subtests passed
• schemas: 40/40 + 100/100 + 97/97 + 97/97
• all package validators and manifests pass
• offline verification: verified=PASS failures=0
• Astro diagnostics: 0 errors / 0 warnings / 0 hints
• frontend build passes
• active section-B shell syntax and expanded SQL guard checks pass
• private audit packet manifest and packet ZIP hash verify
• independent read-only audit at 10103a3: no blocking findings