Harden proof and package boundaries

[iperev]

Summary

• reject invalid UTF-8 and unpaired Unicode surrogates before JSON identity is computed
• align Go and JavaScript stable JSON for browser-proof digests
• replace prose-based browser HTTP classification with typed errors, reuse admitted snapshots, bound request concurrency, and preserve successful forced shutdown semantics
• keep every record in the admitted requirement-list domain reachable by removing the unrelated fixed pagination-offset ceiling while retaining bounded page sizes
• align CLI input root-shape declarations with native admission and add executable parity oracles
• preserve caller non-claims, remove slice aliasing, reject whitespace-only reasons, and reject skipped tests as always-executable witnesses
• bound PyPI response decoding and verify embedded wheel binary format and architecture
• reduce proof-gate cost through compiled path patterns, indexed proof surfaces, cached Go package discovery, and batched browser CSS inspection
• retire completed temporary implementation documents and clarify source-only release records
• make Mermaid validation operate on the candidate worktree, including untracked non-ignored Markdown and excluding deleted files

Formal basis

Each mutation closes a reproduced counterexample against a named owner boundary:

• invalid representation must be rejected before canonical identity
• machine decisions must depend on typed causes, not caller-controlled prose
• one semantic identity must have one cross-runtime byte representation
• declared CLI input roots must equal native admitted roots
• admitted caller fields must either be projected or rejected
• bounded per-record input does not imply bounded aggregate resource use without a concurrency bound
• admitting a requirement list implies that every record remains reachable through bounded pagination
• a platform-tagged wheel must contain a binary of the matching format and architecture

The removed implementation documents named PR #78 and its required checks as their retirement predicate. That predicate is satisfied by merge commit ca541387fc99bf3e297a879ea98861227aab2888 and the successful required checks on that PR.

Validation

• npm run check
• go test -race ./internal/command/requirementbrowser ./internal/command/requirementcontext ./internal/kernel/admission ./internal/tools/pypiregistry -count=1
• browser proof: 93/93 tests across Chromium, Firefox, and WebKit
• go vet ./...
• go tool staticcheck ./...
• go tool actionlint
• go tool govulncheck ./...
• git diff --check
• `go test ./internal/command/requirementbrowser -run '^TestProjectionQueryKeepsEveryAdmittedRequirementPageReachable

Non-claims

• Local gates do not prove provider CI execution, registry publication, deployment, or production readiness.
• This PR does not perform a broad API consolidation where the audit did not establish one owner invariant or a regression-free migration.
  `
• go run ./internal/tools/commandcontractgen --check

Non-claims

• Local gates do not prove provider CI execution, registry publication, deployment, or production readiness.
• This PR does not perform a broad API consolidation where the audit did not establish one owner invariant or a regression-free migration.