[ADC-688] Prove exact wheel, codesign, and final examples

[wolf75222]

What

• prove the retained macOS arm64 / CPython 3.12 wheel byte-for-byte before importing the native extension;
• bind codesign evidence, installed runtime, conformance, outputs, restart proofs, and all four final examples to the exact retained artifact;
• preserve an already-valid ad-hoc signature instead of rewriting it;
• fail the final gate and release preflight when post-install codesign changes the retained wheel native digest;
• retain the existing fail-closed wheel lane, metadata, source, transcript, and runtime identity checks.

Why

The existing ADC-688 route proved that the installed wheel and the pre-codesign installation were identical, then authenticated the live post-codesign runtime. It did not prove that the native bytes exercised after signing were still the bytes in the wheel later published. A repair confined to site-packages could therefore validate a runtime different from the release artifact.

The new gate closes that gap: the wheel itself must already contain the exact valid ad-hoc-signed native member used by conformance and the examples.

History

History is intentionally preserved. The branch contains the prior thematic commits, explicit merges from master, then:

• a9f7e231 — release implementation;
• b5a384fe — refusal and signature-preservation tests;
• 687aa343 — documentation;
• 6409bf84 — explicit merge of current origin/master (de3f6b56).

No squash, rebase, amend, or force-push was used.

Validation

• 48 targeted release architecture tests passed;
• Ruff passed on every changed Python file;
• source release preflight passed for PoPS 1.0.0;
• generated release/component contracts passed through preflight;
• docs/check_docs.py passed with one pre-existing freshness warning;
• git diff --check passed.

Deliberate limits

This remains a source-only proof update. No native build or wheel build was run in this worktree because the shared native compilation lane is occupied. The PR does not claim real Darwin wheel production, codesign execution, installed-package conformance, or final-example execution. ADC-688 remains In Progress until the release workflow produces and retains that evidence.

[wolf75222]

Suivi source-only ADC-688 poussé en trois commits séparés (sans squash/rebase) :

• f0900f95 lie le nom du wheel et son fichier interne WHEEL à l'unique lane promise macOS/arm64/cp312/Kokkos Serial ;
• 02585bf9 ajoute les refus de dérive CPython/ABI, universal2, tag interne, purelib et build tag ;
• 61a79359 documente le contrat.

Preuves locales : 46 tests d'architecture release réussis, Ruff réussi, scripts/release_preflight.py réussi pour 1.0.0, docs/check_docs.py réussi (un avertissement de fraîcheur préexistant), git diff --check réussi.

Le ticket reste In Progress : aucun wheel réel n'a été construit ici, et aucune preuve Darwin codesign/exécution des quatre exemples n'est revendiquée.