fix: harden Greater Realm preflight verification

[ael-dev3]

Purpose

CI preflight and fail-closed verification hardening for the approved Greater Realm final rollout. The committed readiness report remains NOT READY until protected GitHub evidence closes every listed stop condition.

This PR:

• records the reviewed rollout specification, execution plan, secret-free readiness evidence, C7 14+4 guarded-path clarification, and final-record reconciliation for PR feat(atlas,realm): ship canonical Greater Realm pipeline and next-gen grass #193
• fixes a CI-confirmed child-process lifecycle race in the B0 and prepared auth-bridge checkout attestations
• deliberately refreezes the canonical 384-member source closure and updates only its protected workflow pin
• corrects the production runbook to the executable production-admin-v1 cutover-receipt default and locks that contract with a regression test

It does not change gameplay behavior, open any import/activation/presentation/notification gate, deploy, admit players, send notifications, or merge PR #193.

Failure and fix

At exact head 2edccdb37b3ba94303b95172f36dde1059c5cb45, verify completed 5,108 tests successfully and failed one teardown with ENOTEMPTY while removing a temporary .git directory. The oversized tracked-listing assertion itself behaved correctly.

Root cause: fail-fast Promise.all returned after the bounded ls-files rejection while seven read-only sibling Git processes were still settling. The fix tree first landed at unsigned exact head 260166b7e3461775e3d88a7180b4159b5e6d6152, where all five protected checks passed. A signature-only rebase of the same nine commits produced signed head 7f7ec2429cbdb4df76fe39104df334570d1e07cb; both heads have identical tree 1bb0fedec7a75b63e116552e7b7e9d57b7fba75f, and GitHub verifies all nine commits in that history. Current exact head a627427c2a0c62b3e5e2e7a5736541fae14d1075 adds only the separately reviewed runbook-path correction and its contract test; GitHub also verifies that tenth commit. The runtime/auth-bridge tree:

• drains all eight inspections with Promise.allSettled in both deployers before returning or throwing
• preserves the existing deployment-specific fail-closed error codes and 5-second child limits
• adds a deterministic regression proving an early rejection cannot settle the attestation before a delayed sibling
• refreezes the six changed raw members into manifest SHA-256 aa6a24ac7decb83d0a0b260070ad81abea0af9bfaececf3cdb0c5de742f00e6d
• binds that digest in all 13 protected workflow locations; after normalizing only this pin, all three workflow bodies are byte-identical to base

At a627427c, the runbook default now exactly matches publisher, import, relocation, bootstrap, and C4: ~/.warpkeep/private/production-admin-v1/greater-realm-cutover-receipts. Its new contract test failed against the old text and passed after the one-line correction.

Local evidence at a627427c

• release verifier remains exactly pre-generation; package remains 0.3.43
• public-boundary scan passed: 2,070 tracked paths / 1,515 scanned entries
• focused private-boundary suite remains 207/207; C7 transition tests and the mechanical 14+4 mapping remain green
• 66 relevant auth-bridge assertions passed, including the new drain/boundary tests, B0 workflow, prepared runtime, release projection, and named closure/pin policy cases
• 55 adjacent private-receipt/runbook assertions passed on the corrected tree
• TypeScript build, both guarded static-policy verifiers, the 384-member closure verifier, diff hygiene, and secret scan passed
• two independent code/security reviews found no Critical or Important issue and independently recomputed the closure/pin evidence; a third independent review approved the exact two-file runbook correction
• README and CHANGELOG remain unchanged; the worktree and ancestry checks are clean
• PR feat(atlas,realm): ship canonical Greater Realm pipeline and next-gen grass #193 exact d9c1732 lineage maps to reviewed adaptations through 8200539, 4fbe666, 8d74c717, and 98a3636

The exhaustive prepared-workflow mutation matrix exceeds the managed local runner lifecycle and also encounters a pre-existing macOS sandbox Git stderr warning. Neither condition is waived; the full protected GitHub suite remains required.

Merge gate

Do not merge until all five protected-main checks are green on current exact head a627427c2a0c62b3e5e2e7a5736541fae14d1075: verify, auth-bridge, spacetimedb-module, analyze, and CodeQL. Re-authenticate current main, the synthetic merge result, conversations, and the complete 18-file diff before an author-performed squash merge. A successful PR run is not a substitute for the separately required same-SHA push-triggered Verify run after protected-main integration.

PR #193 remains the separate final integration record. At audited head d9c1732, no source delta remains to port and its stale conflicts must not be resolved merely to make it mergeable. If its head changes, audit and adapt only the new delta; if it remains exact, close it as superseded last only after C7, sequential admission/reconciliation, and final live receipts.