release-prooflisted

# Release Proof Treat release as a two-seal transaction. Never publish from a source checkout merely because its tests pass. Never turn `UNKNOWN`, `SKIP`, `todo`, `0 tests`, dirty state, or an agent report into green. ## Non-bypassable rules 1. Use the exact source SHA and one packed-artifact SHA-256 everywhere. 2. Require zero open GitHub issues for RuvNet Brain. A local fix is not a closed issue. 3. Require every named GitHub workflow to complete successfully on the exact candidate SHA. 4. Reject any test/QE result with zero tests, skips, todos, unknowns, pending jobs, or failures. 5. Require two distinct independent graders scoring at least 95, each bound to the SHA and digest. 6. Install the sealed artifact into virgin Claude Code and Codex homes; test their real entrypoints. 7. Require the source package, Claude manifest, Codex manifest, packed npm version, bundle `brainVersion`/`releaseTag`, and both installed host versions to identify one exact generation. 8. Require the active Brain registry to contain the `ruvnet-brain` RVF store and require narrow, broad, and concurrent cited searches to complete within 80% of their deadline. 9. Publish only through the protected release workflow. Never run `npm publish` or `gh release create` locally. 10. After publication, download npm and GitHub artifacts, compare their bytes with the seal, install both hosts again, query the active MCP again, and require `published-surface-probe` green. 11. Close an issue only aft