Test release identity, rollback and policy holds

[LeiterConsulting]

A successful command and correct smoke-test result can still come from the wrong deployed artifact. Add three disposable release-acceptance scenarios that build actual stdlib zipapps, observe a wrong staged version/digest despite exit 0, verify rollback, then run the correct candidate while retaining the required independent-review hold.

The scenarios also cover unavailable policy without blocking allowed local work, build evidence substituted for runtime evidence, removal of required approval gates, changed policy content, unsent handoffs and inert executable metadata. Extend the test-only audit wrapper with a named fictional private-file read canary and verify that guard with its own negative probe. Add a controlled evidence record and clarify artifact/rollback checks in the delivery module and playbook.

Validation: python tools/exec_ctrl.py validate passed (10 modules, 294 supported local links); python -m unittest discover -s tests -v discovered 111 cases, with 109 passing and two local symlink-creation skips; git diff --check passed. The optional helper, activation entry, adapters, catalog and framework version remain unchanged. Everything uses Python 3.10+ stdlib and disposable synthetic inputs.

This is fixture acceptance, not real organization policy or release approval. Reviewer identities are fictional; the final fixture release record stays blocked. No actual team connector, installed application, customer/production target, scanner or independent cross-IDE adoption was exercised.

Hosted verification for exact head 2081b209fbbe406bf44f8562ceba79884231fcef: PR CI, attempt 2 and push CI, attempt 2 both succeeded. All four Windows/Linux Python 3.10/3.13 checks are green in each workflow, with 111 tests passing and no skips in every job log. Validation and diff checks also passed.

The initial attempts failed to allocate hosted runners for three jobs; those jobs had no runner or executed steps. GitHub annotated: "The job was not acquired by Runner of type hosted even after multiple attempts". Every original job that ran passed. Requested gh run rerun --failed for both workflows; the cancelled jobs recovered, and earlier successful results were retained. No source change or weakened check was required. Initial failed attempts remain historical infrastructure evidence, not application-test failures.