fix(repo): separate source integrity from workspace artifacts

[victorsteele]

PHASE-02 — F-003 + F-004

Closes the approved repository-integrity/workspace-hygiene remediation scope on top of main baseline f8f2a5313a6c1e94ecfc7eeed409e91dff0ca36a.

Exact scope

• Remove stale/transient root SHA256SUMS.txt from the public source tree.
• Add repository source-hygiene verification based on the exact Git commit tree.
• Wire the hygiene gate into the existing source audit.
• Add regression coverage for private/generated/runtime contamination and separation from release checksums.

Exact changed paths

• D SHA256SUMS.txt
• M scripts/test/audit.py
• A scripts/test/repository_hygiene.py
• A tests/test_repository_hygiene.py

No src/**, provider, schema, UI, dependency, version, release metadata, or workflow changes.

Verification

Local Windows authoritative audit:

• targeted hygiene tests: 7/7 PASS
• syntax: 99 repository Python files PASS
• repository source hygiene: 385 public source candidates PASS
• full suite: 658/658 PASS
• repository privacy: PASS
• provider visibility: PASS

Push CI run 33026751504:

• Ubuntu test: SUCCESS — 658/658 PASS
• Windows windows-test: SUCCESS — 658/658 PASS
• syntax: 99 PASS on both
• repository hygiene: 385 PASS on both
• windows-build: SKIPPED
• release: SKIPPED
• artifacts: 0

Frozen boundaries

Version remains 1.0.0.1.50.1; schema remains 7. No app build, package, tag, or release is part of this PR.