Harden snapshot trust and simplify real onboarding

[mohsinht]

Why

This turns the external audit into release-gating code. It preserves the synthetic tutorial and calm UI while narrowing the real v0.1.1 promise to one trustworthy pull-request workflow.

Trust gaps closed

• enforce the authoritative expected source set, including missing, extra, duplicate, self-shrunk, and dependency-order failures
• scan every snapshot string for universal credential shapes and source-specific forbidden content without echoing suspect values
• install an independent validator in the private data repository; scheduled producers may create one branch and PR but may not write to main, edit the gate, or merge themselves
• pin every GitHub Action to a reviewed full commit SHA
• verify Cloudflare Access across HTML, dashboard data, and asset paths

Product and data improvements

• replace the intimidating Prompt Studio path with provider and starter choices, automatic dependencies, and a short permission receipt
• reduce the synthetic one-source generated prompt from 794 lines in the audit to 204
• separate durable source-specific facts from derived presentation blocks
• calculate freshness dynamically, expose real provenance and evidence references, and add bounded snapshot history navigation
• scaffold new sources with a dedicated facts schema
• add a public synthetic Pages demo workflow, compatibility policy, release process, fork sync, support, retention, and key-recovery guidance
• clearly state that Zaati supplies contracts and infrastructure, not built-in Gmail, Jira, calendar, or finance connectors

Verification

• 41 tests pass
• 96.78% lines, 86.94% branches, 93.07% functions across the ingestion core
• TypeScript, ESLint, Prettier, schema, privacy, repository-policy, deployment, tutorial, and production build checks pass locally
• production budget: 84 KB JS gzip, 8 KB CSS gzip, 6 KB synthetic dashboard data gzip
• browser accessibility remains CI-owned because the local runner has no Chrome

Release follow-up

After merge, enable GitHub Pages from Actions if it is not already enabled, verify the live synthetic demo, then create the protected v0.1.1 tag and release only after the maintained ChatGPT path passes end to end.