[Clear1nsight]

Malformed workflows could reach research branches before GitHub parsed them. This adds checksum-pinned actionlint 1.7.12, an exact-commit validator, a standalone workflow-lint job and an opt-in pre-push hook that checks every pushed non-deletion ref, including non-checked-out branches and annotated tags. The hook is documented and is not installed automatically.

The upstream planning run also exposed four selected-result navigation failures. This revision synchronizes the tooling branch with upstream main f626db5c3a3d781d8f7695038776c621651f75e1, updates the CI guide to the selected #4359 replay, and places the status history banner before the first historical checkpoint. The selected result remains conditional κ = 0.0023.

Source-preserving CI integration

Documentation changes select four registered packages. This revision reuses the authenticated historical replay adapter, source-role repairs and six regression tests from #4542, exact predecessor head af86fb28f4fe039d4bb8419850af99a6fc474587. It also corrects the adapter's fork-only publication reference to canonical upstream introduction d11655a9fd1c7eedc52e0e9720158bd17d29192a, preserving the identical manifest blob. A seventh adapter test requires the publication pin to be reachable from HEAD, so a locally cached fork object cannot hide missing upstream history.

• D8 assignment/navigation documents retain their original Git blob and SHA256 authentication as provenance; the mathematical input remains unchanged.
• The original PR3563 Conditional κ = 0.001672188119205421: improved T16 owner packing on the seven-slot k8 word #1042 verifier, tests and receipt run on the authenticated original snapshot. Its old previous-record assertion is not applied to today's selected frontier. Current navigation is checked separately by the existing status tests.
• The locale replay retains historical authentication and executes its declared checks against current documentation.
• The three-coordinate temporal package is replayed without changes.

All original invalidation paths remain declared. No frozen verifier, mathematical source, receipt, source hash or selected-result record is rewritten. No global planner bypass, assertion weakening or path-filter suppression is added.

Validation

Final repair head: ae19b6868d5981fbacdf6950a226d969e603b78d.

• All 145 workflows pass exact-commit actionlint.
• All 24 workflow-guard tests pass, including malformed workflows, wrong linter versions, exact pushed refs, annotated tags, replacement refs and local reusable actions.
• Planning/onboarding suite: 338 tests run, 327 passed and 11 native-Windows tests skipped on Linux.
• All four documentation-triggered package replays pass, including the unchanged temporal calculation and locale checks.
• All original source hashes, historical implementation/receipts and the selected record are retained.

The final-head workflow-lint run and registered-package run report hosted validation. Read outcomes at this exact head. Workflow validation and scoped package replay do not establish a new κ or a complete multiplication theorem. This remains a draft tooling contribution.

Prepared for Clear1nsight with substantial OpenAI Codex assistance. Apache-2.0.