P8: Operate CI, dependency, supply-chain, and rollback certification

[wfprieto]

Objective

Keep exact-source CI, dependency integrity, security, wheel, and rollback certification as one maintained critical path.

Owner

Quality owner

Acceptance

• Six OS/Python matrices pass.
• repository-certification is required on protected main.
• Dependency hashes, vulnerability audit, release evidence, clean wheels, and rollback receipts pass.
• Failure runbook identifies stop, evidence-preservation, recovery, and escalation steps.

Rollback trigger

Any missing required job, stale checkout, unhashed dependency, secret exposure, failed rollback, or aggregate false green.

Non-goals

Release publication, ecosystem maturity, and real-world outcome evidence.

[wfprieto]

Implemented by PR #34 on main. CI, dependency, supply-chain, source-integrity, and rollback controls are now covered by a scheduled drift detector and self-validating workflow. PR certification, rollback checks, and clean-wheel checks passed. Keep open as a recurring operations control.