fix: unbreak release.yml and adopt agent-manifest 0.12.0

[imran-siddique]

Two things, both needed to get 0.5.0 out. Found while cutting the release.

1. My own regression: release.yml was unloadable

Hardening the tag interpolation in #609 added an env: block before run: on the "Attach evidence to release" step. That step already had one after run:. Two env keys in one mapping:

        env:
          REF_NAME: ${{ github.ref_name }}
        run: gh release upload "$REF_NAME" ...
        env:
          GITHUB_TOKEN: ${{ github.token }}

GitHub Actions refuses to load a workflow with a duplicate key. release.yml has produced "workflow file issue" failures on every push since #609 merged, and the v0.5.0 release event ran nothing, so cmcp-runtime 0.5.0 never reached PyPI.

Why local validation missed it: I checked with yaml.safe_load, which keeps the last value for a duplicate key without complaining. I have since re-checked every workflow across the org with a loader that rejects duplicates; this was the only occurrence. An actionlint step in CI would catch this class directly — worth considering, not added here to keep the fix minimal.

2. agent-manifest 0.12.0 changes what this gateway accepts

0.12.0 shipped today and this repo's floor let CI pull it in immediately. Two of its changes land here.

GHSA-6hjj-gh3c-r6wv makes the full-binding requirement enforceable independently of Pydantic's model validator. Five test fixtures here built manifests with no profile carrying only policy_bundle and tool_manifest. They verified because a nested omission was suppressing the check. They are MISMATCH now, correctly, and declare all three required artifacts.

That exposed a real integration question, not just a fixture one. Once a manifest carries system_prompt and model_identity, the SDK's strict artifact verification returns INCOMPLETE, because those bindings are present and this verifier holds no runtime hash to check them against. A gateway holds the running policy bundle and tool catalog and nothing else. Under strict mode it could not accept any well-formed full-binding manifest.

So the gateway now declares its appraisal as scoped, strict_artifact_verification=False. This is the judgement call in this PR and the part worth reviewing.

Nothing is skipped as a result:

• _raise_for_sdk_result still requires policy_bundle and tool_manifest to be MATCH under require_runtime_artifacts, which is the whole of what this verifier can attest
• the SDK attaches a warning naming every binding it did not verify, so a VALID from this path is never mistakable for "all artifacts checked"

The alternative — leaving strict on — means the gateway rejects correct manifests, which is a worse failure than being explicit about scope.

GHSA-mp83-94pc-7wqh moved TPM AK chain appraisal onto the shared certificate-chain verifier, changing the failure detail this repo asserts on. Behaviour is unchanged: an unpinned root is still rejected, with a different message.

Floor raised to >=0.12.0, since both behaviours are now depended on.

Verification

Full suite: 1628 passed, 23 skipped. One local failure, test_distribution_smoke_script_exercises_installed_public_api, is the venv carrying cmcp-runtime metadata 0.4.0 against the tree's 0.5.0; CI reinstalls from pyproject.toml.

Once this merges I will re-run the release so 0.5.0 reaches PyPI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t