Mergen Verdict 2.1.2

2.1.1 shipped a CLI that could not verify.

From a plain pip install mergen-verdict, thirteen of seventeen verbs exited 2 on a missing file:

$ mergen verify --help
can't open file '...\site-packages\scripts\verify_core.py': [Errno 2] No such file or directory

verify, verify-lint, dashboard, status, issues, trends, graph, replay, impacted, pack, calibrate, adapter, and sign all failed the same way. The distribution declared two top-level modules and carried none of the scripts those verbs shell out to.

Fixed

• The wheel carries what the CLI runs. scripts/, core/, dist/, and effort-mode/ now travel inside the mergen_payload package and are located by payload_root, which still prefers a checkout so an editable install runs the code being edited. No source file moved — the trees stay at the repository root, so CI, the install scripts, and every documented python scripts/... line are unchanged. (#44)
• A version literal frozen in a test. test_milestone_contracts.py asserted Status: v2.1.1 — a fifth version source validate_version.py could not see, which would have broken every future release. It now derives the expected version from pyproject.toml. (#46)

Changed

• check_no_reference_text.py skips build output and virtualenvs. It had begun scanning copies of its own source under build/ and reading its own fingerprint list as a finding. dist stays in scope, because dist/native and dist/speckit are sources in this repository. (#44)
• The pinned CodeQL init and analyze steps are back on a single SHA after Dependabot split the pair, and a stray second setup-python pin was swept. (#45)

Verified

Installed from PyPI into a clean virtualenv with no repository in reach: all thirteen verbs respond, and mergen verify writes a schema_version 1.0 report with its .sha256 sidecar.