Require certification and publication tooling to descend from the deny-list merge

[MaxGhenis]

PR #857 adds a sealed deny-list for the candidate-26 pool enforced in loaders, receipts, selection manifests, and the publisher's release contract. Merged code cannot constrain a stale checkout: a builder or publisher run from a tree predating the merge still admits the pool through the gate-failed opt-in. Follow-up: make certification and publication refuse to run from a tree that does not descend from the deny-list merge commit (record the merge SHA once #857 lands), and log the check in the release receipt. Refs #856, #857.

🤖 Generated with Claude Code

[MaxGhenis]

#857 merged at 42ee2c6 (2026-09-03 08:34 ET, all 23 checks green). Per this issue, certification and publication tooling should refuse to run from a tree that does not descend from that commit; record it in the release receipt when implemented.