Publishes the static Linux binary for the source already on main, so a repository pinning a current Gates commit downloads a verified asset for that exact source. The 0.1.1 tag attests 0b0220a36e37b5899e9b298c7b42a7daf6e83850, three commits behind the branch head consumers resolve.
No check, policy field or receipt format changes. src/, tests/, ess/ and the dependency lock are unchanged from 0.1.1, so the binary differs only in the version it reports. That version increment alone invalidates receipts retained under 0.1.1; a fresh scan restores zero-invocation reuse.
.github/workflows/common.yml on main now downloads this release and checks its published SHA-256. The four existing adopters still pin workflow commit 547c6bc58d734e679f21bdeeb365f7dcc88059b1, which downloads 0.1.1; repinning them is a separate coordinated operation.
Validation: cargo run --locked -- gate passed on the tagged tree — 17 tests, cargo fmt --all --check and cargo clippy --all-targets --locked -- -D warnings clean. Shared common / Security and privacy and repository correctness checks passed on the candidate before integration. The asset is a stripped static-pie musl build with every source path remapped; it contains no home-directory string.