fix(authoring): separate offline public evidence from installer security

[777genius]

The public native E2E driver invoked a valid installer dry-run in a zero-network lane. Production installer security consults the Security Index and acquires lintai, so the test failed before lifecycle and packed planner checks could finish.

This separates the executable offline observations from the existing injected planner gate without changing production security. Explicit v2 evidence records real installer help/preflight rejection and keeps successful distributed add --dry-run marked not evaluated. The original successful production CLI requirement remains required for the full goal. Strict v1/private interpretation, lifecycle checks, and the ten-project/thirty-plan matrix remain intact.

Stacked on #199 at cdf0aa4. Head 9606e24: eleven files, 498 additions and 29 deletions. Writer focused checks passed: 11 Node tests, 16 Python tests, three named Go main/release tests and two planner/source-harness tests. Root verified 59 artifact hashes, all eleven source hashes and exact patch before mechanical commit.

Independent hosted review ACCEPT at this exact head; all focused checks passed independently. Fresh candidate and actual public preparation succeeded. The E2E worker then stopped before native execution because the environment denied the required strace/ptrace observation probe. No native TAP, 71-call completion or public ten-project/thirty-plan gate was produced; no reroute or retry was attempted. Current CI: packed Linux and three native platforms passed; Windows amd64 failed and required aggregate failed, so this PR remains draft and is not merge-ready. No old candidate bytes are repinned, and no full E2E, release or security-scanner acceptance is claimed. Production Go, launchers, security adapters, dependencies and preserved YAML functionality are unchanged.

Refs #199

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}