Verify Pylon Prime distributions without weakening runtime negotiation #193

Problem

Pylon can discover prime-agent --version and import the launched package's public SDK, but it cannot prove whether bytes came from a Pylon fork release or determine a fork update from signed build identity. Generic provider maintenance is version-centric and cannot represent distribution channel, provenance, immutable build id, or a verified managed receipt.

Stock Prime must remain a valid configured provider. A missing fork token is not an update warning, and signed provenance must never replace exact SDK/post-attach capability negotiation.

Required outcome

Add Prime-boundary distribution verification and advisory without installing or mutating packages:

• verify the signed preview/stable channel manifest and immutable build manifest from prime-agent#29;
• verify artifact subject digest, GitHub/Sigstore issuer and transparency inclusion, source repository, signer workflow/ref, source commit/tree, and recipe id with a server-owned Node implementation;
• define a private managed-install receipt schema containing build id, channel, monotonic channel sequence, source commit, root digest, and package root;
• classify Prime as stock-or-custom, pylon-unmanaged, pylon-managed, or invalid-receipt independently from runtime capability;
• compute managed update availability from signed channel sequence/build id, never SemVer;
• treat a manually installed fork as capability-negotiable but manual for updates;
• keep a verified installed build working when the feed or attestation service is unavailable;
• reject replay below the recorded channel sequence unless an explicit later rollback flow authorizes it.

Malformed metadata or a forged/missing receipt disables managed updating, not the provider. Pylon continues to resolve the exact configured/PATH binary and package root and retains ACP fallback on bridge/negotiation failure.

Acceptance coverage

• stock 0.8.1 remains ready/manual and never receives a fork update warning;
• exact preview artifact verifies as Pylon-managed only with its matching private receipt;
• manually installed fork and forged distribution metadata remain unmanaged;
• tampered tarball, manifest, attestation, signer, source, workflow/ref, digest, package root, and replayed sequence fail closed;
• equal or misleading versions do not affect build ordering;
• offline/rate-limited feed fails soft and retains the installed build;
• Linux/macOS receipts cover supported runtimes; WSL2 uses the Linux path. Native Windows Prime distributions and .cmd launcher receipts are out of scope until upstream Prime supports Windows; native Windows must remain explicitly unavailable with WSL2 guidance;
• bridge CI consumes exact stock and real preview artifacts so current optional proof tests no longer skip;
• existing exact SDK token plus post-attach negotiation tests remain unchanged.

Scope and dependencies

Depends on deterministic, attested preview publication in prime-agent#28 and #29. This issue owns verification, receipt persistence, classification, advisory, contracts/tests, and internal/user documentation only. It performs no download, install, switch, update, or cleanup.

Keep Prime-specific feed/receipt logic at the provider boundary. Do not bundle Prime into Pylon or generalize the provider maintenance contract beyond the smallest typed status needed by web/desktop/mobile. Coordinate with #114. Comet is out of scope.