Add the composition lock and the kit installer

.github/workflows/verify.yml

@@ -0,0 +1,43 @@
+name: Verify Gates
+
+on:
+  push:
+    branches: [main, 'release-*', 'feat/*']
+  pull_request:
+    branches: [main]
+
+# No secrets required; safe for forks.
+jobs:
+  verify:
+    name: Release Gate Verification
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.11', '3.12']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Run release gate verifier
+        run: |
+          chmod +x build/verify-all.py
+          python3 build/verify-all.py
+
+      - name: Verify surface-scan passes
+        run: |
+          python3 build/surface-scan.py
+
+      - name: Verify the composition lock
+        run: python3 build/check-lock.py kit.lock.json
+
+      - name: Verify ingredient contracts
+        run: python3 build/check-ingredient-contract.py --lock kit.lock.json
+
+      - name: Run the composition lock tests
+        run: python3 -m unittest tests.test_kit_lock