Fix Tip recovery after Stable 1.4.0

[baron]

Summary

• recover Tip publication after Stable 1.4.0/build 36 superseded the retained preparer build 35.15.18
• add a closed schema-v2 resetAuthority bound to the exact authenticated live transition, retained preparer, and Stable epoch
• permit only that exact fail-closed T-to-P recovery while preserving normal P-to-T-to-S progression
• validate the authority in both Tip publisher audit phases and document the recovery checkpoint
• add deterministic release-tooling coverage for missing, mismatched, and tampered reset authority

Root cause

Tip builds sort between adjacent Stable integers. Stable 1.4.0 advanced Stable to build 36 while the live transition retained preparer 35.15.18, so the existing floor guard correctly stopped publication. A plain declaration rollback would also be rejected because live Tip is already transition build 35.15.39.

Validation

• python3 Scripts/test_release_tooling.py
• make release-selftest
• .agents/skills/rpce-contribution-check/scripts/preflight.sh pr-ready
• make dev-release-preflight
• .agents/skills/rpce-contribution-check/scripts/preflight.sh push
• git diff --check origin/main..HEAD
• read-only CLI validation against the authenticated live Tip manifest and Stable build 36 snapshot

PR-ready ran the matching conductor self-tests and generated Xcode workspace validation. All checks passed.

Validation boundary

No signing, notarization, Tip publication, workflow dispatch, or other hosted mutation was performed. The protected workflow remains the final integration proof.

[sentry]

Bug: The rolloutManifestSha256 in tip-rollout.json is an invalid 63-character hash, but the validation code expects a 64-character SHA-256 hash, which will cause a RolloutError.
_{Severity: CRITICAL}

Suggested Fix

Correct the rolloutManifestSha256 value in tip-rollout.json to be a valid 64-character SHA-256 hash. The current hash appears to be missing one character.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: tip-rollout.json#L15

Potential issue: The `rolloutManifestSha256` value in `tip-rollout.json` for the
`liveTip` entry contains a 63-character hash. The `validate_reset_authority_shape`
function validates this using a regex, `r"[0-9a-f]{64}"`, which requires exactly 64
characters. When the Tip publication workflow loads this declaration file, the
validation will fail and raise a `RolloutError`. This deterministic failure will block
the publication process whenever the workflow attempts to load the declaration file
containing the invalid hash.

Also affects:

• Scripts/stable_rollout.py:968~974

_{Did we get this right? 👍 / 👎 to inform future reviews.}