retain live drill evidence

[TheGreenCedar]

Outcome

This closes the post-publication timing/evidence gap for atomic indexing. The protected Linux ARM64 lane now retains the full repo-scale, drill, packet, provisioning, and raw-log artifacts under one exact-head run, with proof-owned sidecars isolated and cleaned by exact identity.

What changed

• added coordinator-only release-evidence mode to the staged platform workflow
• required the same-repository PR head, review-accepted, and a successful exact-head source proof before protected execution
• retained the complete drill and repo-scale artifact trees
• isolated live-test caches and made teardown tolerate an absent-state inventory tombstone while still rejecting live ownership
• moved packet measurement onto one invocation-unique agent namespace, using the same profile/run ID for bootstrap, indexing, status, packet calls, and retrieval down
• kept the workflow CPU-labelled and excluded package, Mac, Metal, signing, and release-closeout jobs

Exact evidence

Exact head: 27c24a1839dbfcfc826f1de584412d71307249aa

• Source proof 29301498656: complete workspace tests and all-target/all-feature clippy passed in 6m28s.
• Protected evidence 29301774689: artifact 8298894630, digest sha256:97185960afc6683fe19745d667311efab0805aba62c53c1d720d10f17024b564.
• Repo scale: full_sidecar; 150,915 nodes, 125,373 edges, 313 files, 0 errors, 19,443 symbol docs, and 1,009 dense docs. Indexing was 42.72s, repeat refresh 25.80s, retrieval indexing 69.31s, status 0.73s, grounding 0.06s, and search 2.26s. The index exceeded the current living threshold and remains a recorded warning.
• Live Serde drill: fresh/full, 3/3 anchors resolved, zero blocked and zero failed commands, 7.69s total. It remains truthfully degraded because 16 source-truth checks await human verification.
• Packet lifecycle: Axios, Redis, and Ripgrep each indexed into a managed dynamic agent endpoint; all nine packet commands completed; exact teardown left no proof containers, networks, processes, listeners, leases, owners, repair files, or run-ID references.

The packet publishable gate then failed on product quality: Axios claim/symbol recall, Redis unresolved candidates, and Ripgrep partial coverage. The evaluator was therefore not reached and no candidate.json or report.json exists. That is retained release-blocker evidence for #958, not an infrastructure or cleanup failure.

Verification

• focused Node benchmark/provenance suite: 86 passed
• benchmark self-test
• workflow policy and syntax checks
• documentation links
• git diff --check
• exact-head workspace tests and clippy
• protected live runner artifact and post-run teardown audit

Non-claims

This PR does not claim packet-quality clearance, an approved performance baseline, a release-eligible candidate, Metal proof, signing/notarization, or release readiness. #958 owns baseline activation and must remain fail-closed until the recorded packet-quality blocker is resolved or deliberately re-scoped.

Closes #956
Refs #910
Refs #958
Refs #922