fix: post-1.0.0 audit remediation — close the code-pack I2 bypass + 19 P11/P12 defects

[RNT56]

A full adversarial audit of the merged P11 (artifact factory) + P12 (verified swarm) surface (28.6k lines, 8 reviewers → independent verify → synthesis) found 20 confirmed defects (1 refuted). All are fixed here. Invariants I1–I7 hold throughout — confirmed independently (backend.go byte-identical, go.mod unchanged, zero Charm in the default binary, no host-side reach).

v1.0.0 was cut before this audit ran, so it shipped with the blocker below. This is a post-1.0.0 patch.

🔴 Blocker (1)

• Code-pack flag injection bypassed the verifier (I2 erosion). validateSelector accepted a leading dash, so a worker Evidence.Value of -run=^$ ran go test -run=^$, selected zero tests, exited 0, and laundered a green verdict on the default swarm path. Fix: reject a leading - + insert a literal -- separator (defense in depth); a test asserts -run=^$/--list are Unverifiable with no box call.

🟠 Major (8)

• Finance keyed checks could never pass — the key var was single-quoted, so sh never expanded it. Resolved key-bearing URL now rides a double-quoted $NILCORE_KEYED_URL env var; key stays out of the command/SourceURL/events (I3). (This is a P11 bug a masking test hid — the deep audit caught what the first targeted pass missed.)
• Swarm false-RED on repeat runs — collate root was the persistent --dir; a stale artifact blocked a fresh green run. Now namespaced per run (.nilcore/swarm/<runID>, git-ignored).
• Pool cap-sharing — effectiveCap keyed on the raw tier spec while the stack cache keyed on the resolved primary, so an inherited strong tier got an uncapped second stack. Now keyed on the resolved primary.
• --egress-allow was a dead flag — now applied to the worker box via roster.EgressFor (narrow-only, R9).
• TipSHA feedback seam absent — IntegrateFunc now threads baseRef=st.TipSHA so each pass folds onto the prior verified tip (was re-integrating from HEAD every pass).
• 3 masking tests (TipSHA, benchmark I2-guarantee, finance keyed) rewritten to actually discriminate.

🟡 Minor (8) + Polish (3)

Hard MaxPasses + no-progress rails; board status/src routed through a shared redactor+sanitizer; dead source-claim trace surface deleted; non-recording budget-headroom check; ShipGate nil-guard + honest docstring; audit reproduction anchored at the cited line; runner cap-binding test with a fan-in barrier; lying-green non-convergence test; pool sentinel no-key-leak test; stale comments corrected.

Verification

make verify green · go test -race ./internal/swarm/... ./internal/pool/ green · go.mod/go.sum unchanged (I6) · every strengthened test passes (the guarantees are now guarded, not asserted). Reviewed the four structural fixes (blocker, finance I3, pool keying, swarm tip-threading) by hand + reproduction.

📝 docs/SWARM.md deltas to apply (kept out of this PR to avoid colliding with the docs workstream)

• §7.1 — the board source-claim trace surface (board.Traces()/ShardOutcome trace) is removed; the real source→claim trace flows via report.ClaimTraces → render.RenderMatrix.
• Termination rails — document the absolute HardMaxPasses (default 50) backstop and the no-progress "stalled" rail (two passes resolving zero new red units).
• Budget — the per-pass global headroom check is now non-recording (Total() vs GlobalCeiling), no sub-cent probe residue.
• Collate root — now .nilcore/swarm/<runID> (git-ignored), isolating runs.
• finance.fred_series / audit.finding_reproduces wording — keyed reach via $NILCORE_KEYED_URL; reproduction now anchors at the cited line (±2).

🤖 Generated with Claude Code