fix: trust on-ramp + hygiene — Action snippet, install checksum, CI, verify (Act-1 PR-C)

[logannye]

Summary

Act-1 hardening, PR-C (trust on-ramp + hygiene). The first-contact and trust surfaces, where a "verifiable" tool wasn't verifying — the §C/§D audit findings.

• The headline Action snippet failed on first copy-paste. logannye/rosalind-budget@v1 doesn't resolve (no such repo, no v1 tag) — the single most important adoption action errored before a user saw the contract work. Fixed to logannye/rosalind@v0.1.0 (the root action.yml) in README + CHANGELOG.
• install.sh advertised checksum verification it never ran. It now fetches the .sha256 sidecar the release ships and verifies before unpacking, aborting on a mismatch. Verified end-to-end against the live v0.1.0 release (rosalind-aarch64-apple-darwin.tar.gz: OK); a corrupted sidecar is correctly rejected.
• The CI cli-e2e checksum was a tautology. It regenerated reference.fa at 1 Mbp without --length, overwriting the committed 4 kbp fixture and checking freshly-generated files against freshly-generated sums — zero protection, and it tested a different reference than ships. Now it pins the committed reference to a known hash (a real anti-corruption gate) and simulates reads from it via --reference, so cli-e2e exercises exactly the fixture the release bundle ships.
• verify gains internal-consistency cross-checks — max_working_set_bytes ≤ peak_rss_bytes, and contract_verdict must agree with peak-vs-budget. The first line against a hand-edited receipt, since the manifest has no self-hash yet. (A signed, tamper-evident receipt is its own Act-2 feature — verify-attest, scored 43 in the audit.)
• Removed the dead IndexFreeIterator/MarkerScanner scaffolding — a public-API next_item() that was unimplemented!() (a panic landmine in the v0.1.0 surface) with zero callers.
• Track Cargo.lock — rosalind ships a binary, so a pinned lockfile is part of the reproducible-build story behind the receipts and stabilizes CI cache keys.

Test plan

• verify_rejects_an_internally_inconsistent_manifest (integration) — a flipped contract_verdict is rejected (exit 5) even though file hashes match
• install.sh checksum verification end-to-end against the live v0.1.0 release (OK) + corrupt-sidecar rejected
• install.sh sh -n clean; ci.yml valid YAML; the pinned reference hash matches the committed fixture
• Full suite green (29 sections); rustc 0 warnings; cargo fmt clean

Deferred (noted, not in scope)

• Signed self-hashing receipt → the Act-2 verify-attest feature (a product surface, not a nit).
• Clippy CI gate → needs clearing the 59 pre-existing lints first (its own cleanup PR).

Act-1 sequence

PR-C of 3 — completes Act 1. PR-A (#33, soundness) and PR-B (#34, real-genome correctness) are open and CI-green. All three are independent branches off main (disjoint surfaces), mergeable in any order. Plan: docs/superpowers/plans/2026-06-02-act1-contract-hardening.md.

🤖 Generated with Claude Code