Verify all four release rungs from installed artifacts

[andrei-hasna]

Summary

• add a real RUNNING rung that verifies .bin/repos, executable mode, source identity, and the opened executable descriptor
• make dirty source trees refuse release-provenance generation
• document and test all four ship-chain rungs and bump @hasna/repos to 0.1.43

Verification

• focused affected tests: 29 pass, 0 fail, 94 assertions
• separate tsc --noEmit: exit 0
• clean build: exit 0; provenance records source_clean: true
• dirty writer negative: exit 1; no provenance file written
• staged and commit-range secret scans: no leaks found
• fixed independent reviewer: GO after one focused remediation cycle
• local full suite: 799 pass, 1 unchanged docs-parity timeout under station contention; hosted CI is the required uncontended full gate

Todos: A3-00213, A3-00299, A3-00300

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO

Independent focused review applies to exact PR head 7a88770d368a9301d30ba7eb4b7b21bebd7630a9.

• .bin/repos resolution, executable mode, and inode identity verified
• opened executable descriptor is both digested and inherited by the child
• named remediation regressions: 29 pass, 0 fail, 94 assertions
• separate typecheck: exit 0
• hosted Typecheck, Test & Build: pass
• staged and commit-range secret scans: no leaks found

No remaining in-scope P0/P1 blocker.