Harden help compatibility and package artifact evidence

[iperev]

Summary

• replace circular byte-hash help approval with semantic compatibility over existing invocation forms, process channels, no-input behavior, and leaf dispatch
• keep descriptor/help truth with the existing CLI parity owner and add independent literal oracles for constrained usage
• replace mtime-based artifact freshness with clean candidate materialization and a content-bound schema-v2 execution record
• separate candidate outputs from provider-derived evidence, reject unowned release state, and confine traversal and reads with os.Root
• add explicit requirement and witness bindings for clean materialization, output ownership, and filesystem confinement

Compatibility Decision

REQ-PROOFKIT-SPEC-018 no longer claims byte-for-byte help text stability. That claim conflicted with truthful CLI constraints already owned by REQ-PROOFKIT-QUALITY-004. Existing root and per-command help entrypoints, stdout/stderr behavior, no-input behavior, and leaf dispatch remain blocking invariants.

Audit Closure

• help byte mismatch: confirmed; resolved by an owner-approved semantic compatibility contract rather than preserving false output
• self-updated help hash oracle: confirmed; replaced by independent literal constrained-usage oracles and alias/process tests
• mtime-only freshness: confirmed; freshness fields removed from schema v2 and old outputs are deleted before execution
• no-input help proof gap: confirmed; every successful help compatibility form now uses a panic reader
• intermediate symlink escape: confirmed; snapshot enumeration and reads are repository-confined and the escape has a negative test
• provider-derived release manifest deletion: confirmed; published/provider manifests are semantically rejected before candidate output mutation
• incomplete requirement binding: confirmed; output ownership/confinement has its own witness path
• duplicate requirement ownership: confirmed; descriptor/help truth remains with QUALITY-004, while SPEC-018 owns navigation compatibility

Validation

• npm run check in a clean detached worktree
• go test ./internal/app ./internal/tools/packageartifact ./internal/tools/packageartifactrecord ./internal/tools/releasecloseoutinput -count=1
• git diff --check origin/main...HEAD
• mutation falsifier: removing the --profile value placeholder is rejected by TestDescriptorFlagConstraintsAreRenderedTruthfully
• independent final review: no remaining findings in the changed scope

Non-Claims

This PR does not prove registry publication, provider attestation, release approval, rollout approval, hermetic or reproducible builds, or production readiness.