Automate OMP compatibility maintenance

[lyc-aon]

Summary

• run an isolated t4-maintainer OMP profile with GPT-5.6 Sol at max thinking and yolo approval for stable OMP compatibility releases
• fence publication on open release-critical T4 PRs and an immutable main SHA, including a second gate immediately before Sol
• verify public provenance, stage local cutovers transactionally, and preserve exact same-version operator overlays for rollback
• send warning-only lifecycle notifications through the local Hermes webhook without persisting failed delivery dedupe
• add temporary-root/process-identity confinement and Linux/macOS command portability

Safety

• processed.json remains independently verified public truth only
• local candidate overlays use a separate exact receipt and sealed mode-0400 rollback artifact
• a missing/tampered rollback artifact never reaches apt
• the timer remains disabled until stage-only installation and a supervised run pass

Verification

• node --test scripts/t4-maintainer-contract.test.mjs scripts/t4-maintainer-integration.test.mjs scripts/t4-maintainer-omp-publish.test.mjs — 181 passed
• python3 scripts/t4-maintainer-notify.test.py
• node --check scripts/t4-maintainer-integration.test.mjs
• bash ops/t4-maintainer/validate.sh
• bash ops/t4-maintainer/install.sh --check