[xLagerFeuer]

Scope

Extend the existing exact two-file, one-use-granted, Git Data ref-creation fork stage to cover the two newly requalified source-native Python patches from merged #249 — without enabling a standalone CLI publisher or broad arbitrary Git push.

• Admit exactly one Python production file under src/<package>/... or scientific_agent/... paired with one tests/.../test_*.py. Existing TypeScript packages/<name>/src|test pairs remain valid.
• Support either a new test (must not exist on source or fork; must have new file mode 100644) or an existing tracked Python test (both source and test preimage SHA-256 mandatory and checked against source+fork, before and after exact one-use stage authorization).
• Reject mixed-language paths, traversal, path duplicates, arbitrary paths, existing-test mode confusion, stale fork test preimages. Continue to enforce two modified paths, matching source/fork base SHA, exact patch SHA, safe text file modes, non-overwriting atomic ref POST and remote readback.
• Make Git Data commit message source-neutral instead of retaining historical HarnessDesk wording.
• Preserve all host authorization, effective policy, native test, disclosure and external publication gates. This PR is source-only; not evidence that a trusted executor has been installed or a fork PR published.

First-party and internal validation

• python3 -m unittest discover -s tests: 684 PASS / 0 FAIL.
• Two real local bare-Git materializer scenarios: Python new test and Python existing test — both PASS.
• Exact Fara/Evidence Bench pilot patch validation + negative fail-closed path/preimage cases.
• python3 scripts/contribution_workspaces.py check, python3 scripts/fork_bootstrap_manifest.py check, python3 scripts/pilot_catalog.py check, dashboard generated check, git diff --check: PASS.
• No third-party pushes or PR POST performed.

Closes no authority issue; follow-up execution remains governed by #6/#56 and the two effective standing mandates.