Check the manifest the canonical install path actually resolves

[MongLong0214]

Closes #492.

Held: dev is frozen for the v0.7.1 promotion. This is opened for CI evidence, not to merge.

The release gate compared the tag, package.json and commitlore --version, and never opened .claude-plugin/plugin.json or package-lock.json. ADR-0026 makes the plugin the canonical install path, so the one manifest a plugin user's install resolves was the one the gate did not look at.

That is not hypothetical: package-lock.json declared 0.1.0 from the first release through 0.7.0 while both manifests moved, and this gate passed every time, because it does not look there. A human found it by reading.

The two lock fields are checked separately because they went stale separately. A missing manifest is a failure rather than a skip — the defect being repaired is a gate that stayed quiet about a file it did not read.

Evidence. Five of the six new cases fail against the previous script and all six pass against this one. That is the property that makes them worth having.

[github-actions]

CommitLore — record lint

Trailers: clean — 1 commit in origin/dev..5b7a823540fc601df2b2d03668eee06b85a1a609
Active constraints: 1 limits · 6 ruled-out · 2 warnings — from 3 records over 2 changed paths

Active constraints for the paths this PR touches

Limits (1)

• r-vergate492 5b7a823 — the gate now covers every versioned manifest that exists today, found by searching for "version" across the tree -- a manifest added later is not covered until someone adds it here, which is the same standing every declaration in this repository has

Ruled out (6)

• r-vergate492 5b7a823 — globbing for JSON with a top-level version key | node_modules and generated fixtures carry that shape, and a gate whose scope moves with the working tree fails differently on a clean clone than on a developer's machine
• r-vergate492 5b7a823 — warning on a missing manifest and continuing | the tag is immutable once fetched, so a release that publishes past an unreadable manifest cannot be corrected afterwards
• r-nobin284 ab2f08f — Keeping the binary classification arm for the installer's wrapper | the wrapper is a shell script that execs node, so trusting it by name would re-admit any extensionless executable called commitlore while the bundle it runs is the thing with an interpreter to check
• r-nobin284 ab2f08f — Relaxing the dogfood Evidence check to allow a missing path | it exists to catch a citation nobody can follow, and dropping the check to accommodate a deletion would retire the guarantee instead of correcting the question it asked
• r-nobin284 ab2f08f — Leaving src/core/paths.ts alone because ADR-0026's inventory did not name it | it was the only remaining code that read files out of a compiled artifact, so leaving it would have left the invariant false while the test asserting it passed
• r-nobin284 ab2f08f — Keeping /dist/commitlore in gitignore in case a binary returns | an ignore rule for an artifact nothing produces is a claim that something might, and the ADR says otherwise

Warnings (2)

• r-vergate492 5b7a823 (claim) — the check runs against the built dist in the workspace, so it qualifies the artefact the workflow just built rather than one downloaded from the release -- the fresh-clone checks are what cover that direction
• r-nobin284 ab2f08f (claim) — an extensionless COMMITLORE_BIN is now ignored rather than honoured -- the hook falls through to the recorded install and to PATH, so a caller who pointed it at the wrapper still gets a working hook, by a different route

git log --follow accepts exactly one pathspec, so renames are not followed for 2 paths; query one path at a time to follow its rename chain

withheld the content of 1 record(s) graded blocked: a Verified trailer matching an injection pattern is reported, never quoted (SPEC §7)

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}