Close remaining validation and publication trust gaps

[mohsinht]

Outcome

This closes the code-level blockers from the second independent audit without reverting the newly merged onboarding animations.

Trust and validation

• centralize privacy, temporal, dependency-evidence, warning, block-ID, unsafe-key, and credential policy in one shared validator
• invoke the shared policy from bundle validation, local ingestion, workflow retries, filesystem validation, and private-repository validation
• enforce IANA timezones, coherent local snapshot dates, bounded bundle drift, future evidence rejection, and freshness SLA limits
• reject synthetic or weakened privacy metadata on real publication paths
• add GitHub fine-grained PAT and npm token shapes
• add parity and adversarial regression coverage

Independent publication boundary

• load the private validator workflow from the protected base branch with pull_request_target
• check out candidate snapshots by exact head SHA as inert data
• run no candidate code and retain read-only workflow permissions
• reject workflow, zaati.data.json, and all other mixed-purpose changes
• document exact producer permissions and explicit denial of Actions, Workflows, Administration, settings, secrets, variables, and environments access
• state clearly that candidate JSON enters a private branch before CI and that the gate controls merge, not first Git storage

Source-contract alignment

• add dependency-aware data-repository:init --sources
• generate a matching private-repository setup file from every Prompt Studio profile
• support custom and single-source contracts
• enforce registered workflow IDs against their immutable source lists
• test the one-source money path end to end

Product and packaging honesty

• state the read-only dashboard boundary in the README and app
• use one canonical six-source overview definition
• remove the broken live-demo link until Pages exists
• remove the unsupported Discussions route
• replace nonexistent release defaults with required full-SHA placeholders
• mark v0.1.1 as unreleased until provider and hosted-demo evidence exists
• distinguish portable hosting from the maintained Cloudflare recipe

Verification

• Prettier: passed
• ESLint: passed
• repository, data, privacy, and deployment policies: passed
• tests: 46 passed
• coverage: 97.18% lines, 85.12% branches, 93.86% functions
• production build: passed
• repository-base-path build: passed
• performance: 84 KB JS gzip, 8 KB CSS gzip, 6 KB data gzip
• tutorial retry and atomic transaction: passed
• local accessibility could not run because this workspace has no Chromium; the required GitHub accessibility job will provide the authoritative result

Still requires repository-owner settings

After merge, the owner still needs to enable Pages, set the demo variable, configure homepage/topics, and optionally enable Discussions. A v0.1.1 tag should be created only after the documented provider and hosted-demo release gates pass.