[sinkog]

The defect

In Python the end anchor `$` also matches in front of a final newline. `DIGEST_RE.match` and `COMMIT_RE.match` in `tools/release_record_conformance.py` therefore accepted `<40 hex>\n` as a `source_commit` and `sha256:<64 hex>\n` as an artifact digest. The contract says 40 / 64 lowercase hex digits. Found by a test of the pre-check (#29), reproduced here.

Proof first (against the verifier of devel, before the fix; record re-authenticated so the refusal has to come from the contract check)

Vector	Expected	Verifier of d2d8ec7
`source-commit-trailing-newline`	FAIL / `source_commit_form`	PASS
`digest-trailing-newline`	FAIL / `artifact_digest_form`	PASS
`manifest-digest-trailing-newline`	FAIL / `artifact_manifest_digest_form`	FAIL, wrong reason (`artifact_manifest_mismatch`)
controls: two newlines, `\r`, leading newline, trailing space	FAIL, same reason	FAIL, same reason (unchanged)

The old verifier is read from git inside the test (`test_the_verifier_of_d2d8ec7_did_not_refuse_it_for_that_reason`), so the proof runs in CI; where the history is required its absence is a failure, not a skip.

The fix

Both patterns end with `\Z`. Two lines of the verifier.

The frozen yardstick: amended explicitly, not edited

• `tests/fixtures/envelope3/FROZEN.sha256` is untouched and still checked against the blobs of d2d8ec7.
• New `tests/fixtures/envelope3/AMENDMENTS.yaml` lists exactly two files: the verifier, and `tests/e3_mutants.py`. For each: the digest it had (must equal the frozen one), the digest it has (must equal the working tree), and the reason.
• `tests/test_conformance_frozen.py` checks all three, that every amendment starts from the frozen digest and changes something, and that a release record can never be amended. Shown red both ways: an unlisted edit of `e3_vectors.py`, and an amendment with a wrong `from_sha256`.
• `tests/e3_mutants.py`: nine mutants carry the text of the changed lines; the change is mechanical (`$` to `\Z` in them). None added, removed or retargeted. A first version of this PR missed the ninth and the planted suite failed with 79 errors; fixed and re-run.

Not changed, and why

• The v0.2.1 record and every release. The released record still passes `record`, `blobs` and `crypto` with the fixed verifier (test pinned by commit id and SHA-256).
• The compiler. `SOURCE_COMMIT_RE` has the same shape but reads the `.strip()`ped output of `git rev-parse`, where a final newline cannot occur.

Checks

• Planted defects: the anchor put back at each place turns the targeted vectors red; the unmutated copy passes.
• Full suite with `CIC_REQUIRE_RELEASE_HISTORY=1`: 815 passed, 0 skipped (794 on devel).

Merge is for the owner.