Authenticated Node2Shell rules 3.1

Existing embedded snapshot, keylessly signed by the pinned main-branch publishing workflow. Verify publisher identity, expiry and durable sequence state before use. No automatic checker update or safety attestation.