Disable unverified commercial and mint rails

[bshelby88]

Outcome

This follow-up repairs the third independent blocker while keeping all commercial and mint rails fail-closed.

• Rewrites all 10 Wisdom Drops item metadata files plus collection.json to use https://royalruby.io canonical image/external URLs.
• Removes unsupported animation_url values (the referenced videos are not in the deployable repository), all Unlockable descriptions/traits, open-edition/holder-benefit copy, and royalty/treasury placeholders.
• Copies the complete supported Wisdom Drops metadata/art tree into dist.
• Adds independent current-tree and built-dist tests for every one of the 11 metadata files.
• Pins Vercel to npm run build + dist, emits exact-commit deployment-provenance.json, adds an expected-commit health gate, and adds GitHub quality gates for PRs and every push to canonical production branch master.
• Preserves the inert publisher, Coming Soon NFT/Frame, no frame transaction metadata, privacy/attribution, deny-by-default checkout, waitlist-only truth, Formspree interest capture, and Vercel analytics.

Strict TDD evidence

• New metadata/deployment suite initially failed 24 of 25 tests: all 11 current metadata cases, all 11 missing dist cases, Vercel build pinning, and provenance.
• After adding workflow and live-health expectations, implementation brought the suite to green.
• Sabotage run restoring https://royalruby.co in item 1 failed the exact per-file test, then the clean file was restored and the full suite rerun.

Verification for exact head 67b49565d570564314334b433efa112d1e7afc3d

• npm test — 67 passed across 4 files
• npm run build — production artifact emitted to dist; 11 metadata JSON files parse successfully
• npm audit --audit-level=high — 0 vulnerabilities
• Local production health with EXPECTED_COMMIT=67b49565d570564314334b433efa112d1e7afc3d — 14/14 passed, including provenance
• Independent current + dist metadata truth scans — clean
• git diff --check and added-line static security scan — clean
• GitHub production-truth workflow passed on predecessor 09c8501dd4550e5b4ae4acbfbe7676882c50aced; latest exact-head Vercel/CI checks are pending

Production truth / remaining gap

Source-first inspection found no prior GitHub workflow. Vercel Git integration has historically deployed master to Production, so reviewed merge to master remains the canonical production path; this PR does not introduce a second deployer. Current production is still the old master SHA 372a85c11919972c2cac8b51dc0703ef6ef9506c, returns stale royalruby.co metadata in the landing page, and returns 404 for /deployment-provenance.json. That gap cannot close until this PR is independently approved and merged, after which the Vercel integration must deploy the merged master SHA and the provenance health check can verify it exactly.

No merge, production deployment, payment, mint, publish, account change, or duplicate-project deletion was performed. The duplicate royal-ruby-pr2 Vercel project was not mutated manually.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
royal-ruby	Ready	Preview	Aug 26, 2026 6:39pm
royal-ruby-pr2	Ready	Preview	Aug 26, 2026 6:39pm