lockstep-version-guard

# Lockstep version guard ## Contract | Field | Bound contract | |---|---| | Trigger | A human explicitly invokes the guard at a release gate. | | Authority | Read-only: inspect local release metadata without changing files, version control, credentials, paid services, published artifacts, deployments, or remote state. | | Side effect | None; the check writes no project state. | | Done | Exit 0 when every checked version equals the canonical version; otherwise exit 1 with a per-file listing. | ## Inputs Supply the release root. The identity ledger `catalog/plugins.json` under it must provide the canonical `releaseVersion` and enumerate the 28 ODIN package members, each identifying its version-bearing `plugins/<id>/plugin.json` via its `directory` field. No input is optional. ## Procedure 1. Resolve the supplied release root without changing the working tree. Reject a missing, unreadable, or non-directory root. Done when: the release root is resolved and confirmed as a readable directory. 2. Read the canonical version from the `releaseVersion` field of `catalog/plugins.json`. Reject a missing, non-string, or empty version. Done when: the canonical version is read and confirmed as a non-empty string. 3. Read the `entries` array of `catalog/plugins.json` and collect the version-bearing manifest each entry identifies (`plugins/<id>/plugin.json` resolved from the entry's `directory` field). Require exactly 28 distinct ODIN package entries; reject duplicate, missing, out-of-...