Rate of Closure: qualify deterministic static web distribution

[d-sorgcodexagent]

Summary

• make production Vite output descriptor-bound, network-silent static inspection while retaining the authenticated development companion
• generate and consume one deterministic, strict-UTF-8 asset manifest with bounded paths, exact sizes/SHA-256/media types, immutable Python snapshots, and no public source maps
• qualify exact-revision wheel admission through a clean-Git build hook, complete archive audit, isolated install, generic sdist/wheel separation, and an ephemeral hosted CI gate

Security and distribution boundaries

• production bootstrap fails closed before React mount for missing or malformed runtime metadata
• packaged readiness requires static_inspection and exact manifest/runtime revision agreement
• public PR code does not execute on the persistent self-hosted fleet; checkout credentials are not persisted
• generic wheels and source distributions remain valid but intentionally contain no qualified web bundle
• this does not claim a production same-origin execution companion, Playwright qualification, frozen artifacts, Windows authority-state privacy, signing, SBOM, or protected release

Local evidence at exact head 277ef9427a6fbed39841f07411e2e7844382e698

• React: TypeScript + ESLint clean; 138 files / 922 assertions pass; 6 Node artifact tests pass, 1 Windows-token symlink test skipped
• Python Rate-of-Closure: 1,266 pass, 2 platform/token skips
• focused distribution + campaign contracts: 20 pass, 1 token skip before final duplicate-member addition; final focused distribution: 13 pass, 1 token skip
• Ruff, format, MyPy, Bandit, changed-Python policy, module budget, campaign manifest, YAML parse, and git diff --check pass
• exact commit-bound wheel: 71 declared assets; archive verification, --no-index --no-deps install, and unrelated Unicode-CWD immutable resolution pass
• stale build/lib reproduction was caught by the exact wheel gate and fixed by clearing only the verified Rate-of-Closure web staging subtree

Stack

Targets the exact Tools PR #4376 branch and preserves the normal dependency order. Human review was approved operationally by the owner; ordinary protected repository checks and non-admin merge behavior remain authoritative.

Closes #4378

[dieterolson]

Consolidated into #4410. Closing to reduce CI/CD runner load.