Supply-chain qualification

Supply-chain evidence covers locked dependencies, action pinning, component manifests, SBOM generation, provenance, signature verification, TUF metadata, offline closure, transactional activation, health checks, and rollback targets.

T76 assembled these controls into a reproducible, published candidate. T77 verified the exact candidate and recorded the human release decision: a signed reject, held.

The repository remains at 0.0.0-qualification; the published launcher installs that build through this path.