Add attributable fail-closed verifier evidence

[Riverbraid]

What changed

• Adds tests/verify-fail-closed.mjs.
• Runs the real verify.mjs positive path and checks for VERIFIED with no failure codes.
• Copies the exact verifier subject into an isolated temporary workspace, removes required AUTHORITY.md, and asserts:
  • exit code 1;
  • verify-output.json is still produced;
  • status is FILES_PRESENT_UNVERIFIED;
  • AUTHORITY.md appears in missing_files;
  • REQUIRED_FILES_MISSING appears in failure_codes;
  • the declared claim boundary remains present.
• Pins the workflow to Ubuntu 24.04, Node 24.11.1, and exact checkout/setup-node action commits.
• Uses npm ci --ignore-scripts only when a lockfile is present.

Exact-head validation

Current head:

a05c341af05fe9b5663c5dc8d6e85084e0118cdc

GitHub Actions run 30288938156, job 90053623558, completed successfully.

Successful steps:

• positive verifier execution;
• isolated missing-required-file negative execution;
• fail-closed exit and output assertions.

The bounded emitted evidence is:

REFUSAL_GOLD_POSITIVE_PASS
REFUSAL_GOLD_FAIL_CLOSED_NEGATIVE_PASS

Boundary

This PR directly exercises the original fail-closed fault. It does not change the verifier result grammar, required-file set, registry state, protocol authority, releases, tags, or the F0–F4 control package.

A successful repository-owned workflow is bounded execution evidence for this exact source state. It is not certification, external audit, independent reproduction, production readiness, complete security assurance, adoption, or absence of defects.

The PR remains draft and unmerged; main-branch incorporation remains a separate disposition.