Tighten release-candidate publication surfaces

[GsCommand]

Motivation

• Ensure repository surfaces accurately reflect a pre-publication, release-candidate posture for v1.1.0 and remove any broken integrity/trust signals for archival v1.0.0 so the repository is safe to review before tagging.
• Remove overstated "published" claims and avoid implying external publication proof the repo cannot demonstrate yet.
• Neutralize the fastest-to-apply trust hazard for dist-pin/agent-cards/v1.0.0 so it cannot be mistaken for a verified release artifact.

Description

• Updated discovery and registry descriptors to a release-candidate posture by changing publish_state from published to release_candidate_pending_validation and tightening descriptive text for release-candidate language in .well-known/agent.json, .well-known/agent-cards-v1.1.0.json, meta/commons-agent.json, and meta/commercial-agent.json, plus their copies under dist-pin/agent-cards/v1.1.0/.
• Adjusted meta/manifest.json (and the rebuilt dist-pin/agent-cards/v1.1.0/meta/manifest.json) to stop using roots.published_bundle, rename it to roots.derivative_bundle, narrow the dist_pin surface role language, and add publication.state: release_candidate_pending_validation and publication.external_bindings: unconfirmed_until_validate_release_passes.
• Neutralized the dist-pin/agent-cards/v1.0.0 trust surface by removing its stale checksums.txt, inserting dist-pin/agent-cards/v1.0.0/ARCHIVE_NOTICE.md, and annotating v1.0.0 metadata with archive_state: archival_only_unverified_snapshot and trust_notice: integrity_manifest_removed_due_to_incomplete_bundle so v1.0.0 remains archival-only and not integrity-claimed.
• Aligned release-facing documentation to the pre-publication posture across README.md, SPEC.md, SECURITY_PROVENANCE.md, ONBOARDING.md, and POLICY.md to describe v1.1.0 as a release-candidate and defer publication claims until validate:release + external binding checks pass.
• Files changed (high-level): .well-known/agent.json, .well-known/agent-cards-v1.1.0.json, meta/manifest.json, meta/commons-agent.json, meta/commercial-agent.json, dist-pin/agent-cards/v1.1.0/* copies, dist-pin/agent-cards/v1.0.0/* (annotated and checksums.txt removed), ARCHIVE_NOTICE.md added under dist-pin/agent-cards/v1.0.0, and docs README.md, SPEC.md, SECURITY_PROVENANCE.md, ONBOARDING.md, POLICY.md, plus refreshed checksums.txt.
• Publication-state values changed: publish_state → release_candidate_pending_validation in the descriptors listed above; roots.published_bundle → roots.derivative_bundle in meta/manifest.json; added publication.state: release_candidate_pending_validation and publication.external_bindings: unconfirmed_until_validate_release_passes.

Testing

• node scripts/build-dist-pin.mjs — succeeded and rebuilt dist-pin/agent-cards/v1.1.0 successfully. (✅)
• node scripts/generate-checksums.mjs — succeeded and regenerated root checksums.txt to reflect the edits. (✅)
• npm run validate — repository-local validation (structure, manifest/card alignment, checksums) passed. (✅)
• npm run validate:release — derivative-bundle reproducibility checks passed but the run failed overall because external resolution of upstream tagged Commons/Commercial schema URLs could not be fetched; mirrors resolution is still pending so publication claims are deferred. (partial success; external fetches failed)

---

Codex Task