Harden Braid CI orchestration against false green

[srinji-kaggss]

Based on main at 3a89e608. Advances #78.

The gap

Braid's documented assurance floor was not the floor GitHub actually executed. The workflow could turn an API failure into "no stack blocker", external actions used mutable refs, path classification could skip required lanes, one job had no timeout, and cleanup could run before five run-owned target directories were finished. The documented Keel command also targeted a deleted Node adapter.

That means a green run could describe orchestration success without proving that the intended work ran.

The fix

• Run the complete Braid gate for every change.
• Fail closed when stack-position lookup fails.
• Pin every external action to an immutable commit SHA, including Checkout
  v7.0.1 on its declared Node 24 runtime.
• Give every job a positive timeout.
• Make cleanup wait for every prior job and remove all six exact run-owned target directories under always().
• Add a small source-policy checker and six black-box negative fixtures.
• Replace the dead Keel adapter with an explicit native keel invocation and truth-sync the assurance documentation.

I rejected expanding the source classifier. Every new workflow, script, or data extension would reopen another skip hole, while this repository's required gate is fast enough to run for every change.

Real user path

Green path:

$ ./scripts/ci-policy-check.sh --self-test .github/workflows/ci.yml
ci-policy: OK actions=13 jobs=15 bytes=15747
ci-policy: self-test OK (6 negative fixtures)
exit 0

Red path:

$ PATH=/usr/bin:/bin KEEL_BIN= ./scripts/keel-floor.sh
native Keel is unavailable; install it or set KEEL_BIN
issue #78 tracks a hermetic Braid assurance distribution
exit 127

The policy self-test also injects each prohibited workflow shape and requires a nonzero result before accepting the checker.

Proof of teeth

Mutation	Required result
Mutable external action ref	rejected
continue-on-error: true	rejected
Executable shell failure swallow	rejected
Job without a timeout	rejected
Cleanup before all jobs	rejected
Scope-based required-lane skip	rejected

The documented Keel gate did not exist

The old adapter expected keel/src/run.mjs, but the current Keel is native and not hermetically distributed to Braid CI. This change makes that absence explicit rather than preserving a stale success claim. Native Keel remains diagnostic until #78 establishes a reproducible distribution and closes the existing findings.

Full CI, run locally at 3b8dcead8d5d8a26e5a72ff14c6097416544af10

Evidence	Result
.wwfd/local-ci.sh	32/32 steps green
CI policy self-test	6/6 negative fixtures rejected
Release verdict	admit
Registry SHA-256	1fac13b0e2798ef3540052a1e9ce0468b3c0fc943d6beb472494554edc1c98e5
Registry CID	afaa7dcc9ab2f7d1530da72306c7d821c573f8aa9eda2b5c6e463f121f634acd
Capsule CID	ccedc469e6b0513720969ce1a4f169f53365eeadbc853042c411b44c1f15b71f
Consumer lock SHA-256	c0aeda7f6a8941dced115397d191c664532f0f5d895a0f1db09ed4b433abbbba

What is still not done

• P1: Close Lean-Rust conformance and make assurance release-repeatable #78 remains open: current native Keel reports 456 findings across 212 files on this branch, and its binary is not yet a hermetic CI input.
• The signed release tag tracked by P1: Build a hermetic reproducible Braid publish and release path #75 is not cut. It should not precede this CI fix.
• Downstream consumer convergence in P1: Establish the first live Braid consumers in kernel and browser #76 remains blocked on a ratified release.