feat(ci): seal the gate against HTML-output tampering (B5)

Adds verify_reviews.py --reproduce: re-renders each managed HTML from its source MD (committed render-manifest flags) and diffs modulo the generation timestamp, catching a hand-edited HTML body whose source/meta were left untouched — the one real hole the B4 Codex review flagged. CI now runs --mode strict --reproduce.

Hardened per a fresh Codex adversarial review of this seal (thread 019e7d44): fail-CLOSED (a managed product absent from the manifest is HTML_TAMPERED, not skipped; a missing/unparseable manifest is fatal exit 2); _normalize() strips the timestamp only in its 3 template-generated spots (not globally) so a body timestamp can't hide a tamper; subprocess pinned to cwd=repo-root; CI paths now include render_html.py / templates/ / manifest, and the code declares renderer+template+manifest a trusted TCB needing human review.

docs/index.html re-rendered onto the current template (it had been left on the 2026-05-20 template) and added to the render manifest. Verified: 47 artifacts reproduce byte-identically modulo timestamp; body tamper caught; deleting a manifest entry fails closed; missing manifest aborts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: wanshuiyin

.github/workflows/review-audit.yml

@@ -11,12 +11,18 @@ on:
     paths:
       - 'docs/**'
       - 'tools/verify_reviews.py'
+      - 'tools/render_html.py'
+      - 'tools/templates/**'
+      - 'tools/tutorials_render_manifest.json'
       - '.github/workflows/review-audit.yml'
   push:
     branches: [main]
     paths:
       - 'docs/**'
       - 'tools/verify_reviews.py'
+      - 'tools/render_html.py'
+      - 'tools/templates/**'
+      - 'tools/tutorials_render_manifest.json'
       - '.github/workflows/review-audit.yml'
   workflow_dispatch:
 
@@ -35,5 +41,5 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
-      - name: Verify the review audit chain (strict)
-        run: python3 tools/verify_reviews.py --mode strict
+      - name: Verify the review audit chain (strict + reproduce)
+        run: python3 tools/verify_reviews.py --mode strict --reproduce