fix: trust on-ramp + hygiene — Action snippet, install checksum, CI, verify

The first-contact and trust surfaces, where a "verifiable" tool was not
verifying:

- The headline Action snippet `logannye/rosalind-budget@v1` did not resolve
  (no such repo/tag) — the single most important adoption action failed on
  first copy-paste. Fixed to `logannye/rosalind@v0.1.0` (the root action.yml)
  in README + CHANGELOG.
- install.sh advertised checksum verification but never ran it. It now fetches
  the `.sha256` sidecar the release ships and verifies before unpacking,
  aborting on a mismatch (verified end-to-end against the live v0.1.0 release;
  a corrupt sidecar is correctly rejected).
- CI cli-e2e regenerated reference.fa at 1 Mbp without --length, overwriting
  the committed 4 kbp fixture and checking freshly-generated files against
  freshly-generated sums (a tautology that also tested a different reference
  than ships). Now pins the committed reference to a known hash (a real
  anti-corruption gate) and simulates reads FROM it via --reference.
- verify gains internal-consistency cross-checks (max_working_set <= peak_rss;
  contract_verdict agrees with peak-vs-budget) — the first line against a
  hand-edited receipt, since the manifest has no self-hash yet (a signed
  tamper-evident receipt is its own Act-2 feature).
- Removed the dead IndexFreeIterator/MarkerScanner scaffolding: a public-API
  next_item() that was unimplemented!() (a panic landmine) with zero callers.
- Track Cargo.lock (rosalind ships a binary → a pinned lockfile is part of the
  reproducible-build story and stabilizes CI cache keys).

Full suite green; rustc 0 warnings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: logannye

.github/workflows/ci.yml

@@ -94,11 +94,20 @@ jobs:
           toolchain: stable
           profile: minimal
           override: true
-      - name: Generate toy dataset
-        run: python3 scripts/generate_toy_data.py examples/data/illumina_toy
-      - name: Verify checksums
-        run: sha256sum --check SHA256SUMS
-        working-directory: examples/data/illumina_toy
+      - name: Verify the committed toy reference is intact (pinned hash)
+        # A real anti-corruption gate, not the old self-referential check: pin the
+        # COMMITTED reference.fa (the one the release bundle + every other job
+        # ships) to a known hash. The previous step regenerated reference.fa at
+        # 1 Mbp without --length, overwriting the committed 4 kbp fixture and
+        # checking freshly-generated files against freshly-generated sums (a
+        # tautology that also tested a different reference than ships).
+        run: |
+          echo "ce8a6df801e836f4eda0b7661a68dcd7b7a9ab247c66d4582a89dbc207554efa  examples/data/illumina_toy/reference.fa" \
+            | sha256sum --check
+      - name: Generate reads from the committed toy reference
+        # --reference simulates reads FROM the committed reference (does not invent
+        # or overwrite one), so cli-e2e exercises exactly the fixture that ships.
+        run: python3 scripts/generate_toy_data.py examples/data/illumina_toy --reference examples/data/illumina_toy/reference.fa
       - name: Align to SAM
         run: |
           cargo run --release -- align \

.gitignore

@@ -2,7 +2,8 @@
 /target
 **/*.rs.bk
 *.pdb
-Cargo.lock
+# Cargo.lock IS tracked: rosalind ships a binary, so a pinned lockfile is part of
+# the reproducible-build story behind the receipts (and stabilizes CI cache keys).
 
 # IDE
 .idea/

CHANGELOG.md

@@ -12,7 +12,8 @@ contract** — predict it before you commit, honor it during the run, and verify
 - `rosalind variants … --enforce` — honor the budget: refuse up front (exit 3) or fail loud (exit 4),
   never a silent OOM-kill. Record-only without `--enforce`.
 - `rosalind verify` — re-check a run's BLAKE3 receipt without re-running.
-- The **`rosalind-budget` GitHub Action** — enforce the contract in *your* CI (fail the build on breach).
+- The **Rosalind budget GitHub Action** (`action.yml`, used as `logannye/rosalind@v0.1.0`) — enforce the
+  contract in *your* CI (fail the build on breach).
 
 ### Variant calling
 - **Bounded whole-genome germline SNV calling** (`variants --index`) over a coordinate-sorted BAM and a