fix(publication): isolate offline release builds

[rynfar]

Problem

Preview Pack B failed with EACCES when Docker left root-owned output, and the old boundary could execute downloaded or repository code as root. The release path needed to fail closed without exposing the original checkout, runner control state, credentials, or the real publication candidate to dependency-backed processes.

Fix

Use one trusted host orchestrator with an exact pinned Linux/amd64 Node image and pinned npm archive. It separates dependency, pack, contract, candidate-preparation, final-verification, cache, and smoke work into disposable least-privilege phases. The real candidate is frozen, verified read-only, bound to a canonical receipt, and copied through bounded no-follow file descriptors into an output directory that containers never mount.

Keep install gates pinned and tokenless across Linux and macOS, including complete historical subject verification. Publication policy revision 3 is append-only and binds the exact final preview and stable workflow bytes.

Verification

• Exact base: 68603ed89bb597cd715fd6a77bc1c39d7e110298 (merged fix(publication): authenticate stable checkpoint retirement #52). Exact rebased head: 64f0a13585aa1a8be5ae4403dcb6339360e59eb0; tree: 4d11f900675f32a8edcdf8d41306627ab2146a48.
• The branch is one sandbox commit over the base. git range-diff reports the old 330587ca241bdd045ec6f11299e5ece133350ad7 patch as exact =. A clean base/head merge-tree equals the rebased tree.
• The base bounded-file blob f43bc3292d84d4fa779c035667387e15b832f126 and consumer-lock blob eaf377c474efab6533b0bd98d6bb1b2a6cde1aa5 are byte-identical at the head. Every non-overlapping sandbox/workflow/policy blob is byte-identical to the reviewed old head. The shared publication test file retains the merged fix(publication): authenticate stable checkpoint retirement #52 cases plus the unchanged sandbox patch.
• The combined publication suite passed 39/39 twice sequentially and in two concurrent processes. The count is 39, rather than the prior 37, because both merged fix(publication): authenticate stable checkpoint retirement #52 tests are preserved.
• Exact Linux/amd64 Docker CI and preview pack paths passed with Node 22.23.2, npm 11.10.1, image node@sha256:87a4f951f28b85d189df365d24c479d3bdb70be77c1ff5c9029db2ef67e251ac, and config sha256:6622b5ce13429346f91fcdb936ec2e026ccc28465409fd25b7f79c623e7a20af. Dependency, offline pack, 10/10 release contract, 39/39 publication contract, candidate preparation, canonical final receipt, and frozen final copy all passed in both modes. The five common CI/preview subjects were byte-identical.
• Exact Linux CI, preview-current, and historical artifact installs passed. Native macOS CI, preview-current, and historical artifact installs passed.
• Every container ID captured by each successful sandbox run exited zero and was destroyed. Pylon container inventory was empty before and after each successful phase.
• npm run test:pylon-release: 10/10 passed.
• npm run test:pylon-ruleset-auditor-app: 6/6 passed.
• Modified-workflow actionlint, npm run check, and git diff --check 68603ed89bb597cd715fd6a77bc1c39d7e110298..HEAD passed.
• Raw diff: https://github.com/pylon-code/prime-agent/pull/50.diff

Fresh CI run https://github.com/pylon-code/prime-agent/actions/runs/33795426695 completed at the exact head. Thirteen checks passed. Both artifact-pack replicas reached 38/39 and failed the preserved merged-base consumer test 29 with Consumer high-water journal root changed without one exact current or immediate-successor authority. Reproducibility and install were skipped, and the aggregate failed as a consequence. No manual rerun was requested. The same combined suite passed twice sequentially, in two concurrent local processes, and in both exact local Docker contract phases; this remains a load-sensitive merged-base consumer race outside this sandbox-only commit.

The prior independent security and workflow reviews remain patch-applicable because the sandbox commit is range-diff identical; no new review was performed for this rebase.

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}