docs(handoff): nebula-verifier-guard — the two-tier split that hid a broken script, and a battery that cannot be certified

[ZacxDev]

Canonical handoff for the nebula-verifier-guard effort. New doc — no existing handoff references #1407 or #1420, and the four that mention apply-nebula-relay.sh do so only as untracked files blocking ship.sh.

The session's stated goal is DONE and verified: home-manager switch is clean on both hosts (only the upstream install→add line remains, which upstream fixed then reverted for Lix). #1384, #1398, #1407 merged and shipped; #1410 closed as obsolete.

What the doc is actually for is the work that goal uncovered:

• main was red for two unrelated reasons; one was feat(nebula): advertise a nebula relay — a read-only check, and the sudo apply beside it #1272 merging on a dev-host green while the nix sandbox — which has no /usr at all — failed 20 tests on a #!/usr/bin/env shebang.
• fix(nebula): pin the interpreter fix tier-independently, and stop reporting an exec fault as a config fault #1420 is open with four audit rounds of follow-up.
• One genuinely unresolved investigation, captured with verbatim evidence: the mutation battery cannot be certified green on this box. Three consecutive full runs failed a different pair each time, always exactly two, while every mutant passes in isolation — and one reported M-FH-1 as SURVIVED for a mutation measured by hand as failing two tests. Box load 64–93 throughout.

It also advances an existing open item in the subsystem index: test_live_cotenants_sees_another_process_in_the_repo recurred, and #1340's diagnostic — the one that bullet's NEXT PROBE asked for — returned cwd='<gone>' cmdline='<gone>', so the capture has to move to detection time.

Ranked next steps carry forcing: tags; five of six are honestly forcing: none and flagged as not eligible to be worked.