Bind 0.2.3 evidence to attested release assets

docs/RELEASE_EVIDENCE_0.2.3.md

@@ -15,7 +15,7 @@ Release channel: **`v0.2.3-fabric-proof.1`**
 | Packaged owner | Isolated native owner produced controller, proposal-only intelligence, one enrolled node, one signed offer, and an authenticated owner mesh endpoint; close-to-tray and explicit cleanup passed | PASS |
 | Packaged worker | Signed enrollment, authenticated direct QUIC, encrypted artifact round trip, signed sustained benchmark, consumed-invite removal, durable pin restart, tray lifecycle, and no leaked sidecars | PASS |
 | Controller restart | The packaged campaign terminated and restarted the owner controller on its durable mesh port; the running worker retained enrollment and published a fresh signed endpoint automatically | PASS |
-| NSIS lifecycle | Six payloads; install/uninstall exit 0; desktop and Rampage Shell shortcuts; controller/intelligence/node/offer ready; no sidecar leak | PASS |
+| Public NSIS lifecycle | The exact tagged CI asset produced six payloads; install/uninstall exit 0; desktop and Rampage Shell shortcuts; controller/intelligence/node/offer ready; no sidecar leak | PASS |
 | Automatic local AI | Installed Ollama 0.32.5 reported `qwen3:4b`, 2,497,293,931 bytes, and exact artifact digest `sha256:359d7dd4bcdab3d86b87d73ac27966f4dbb9f5efdfcc75d34a8764a09474fae7` | PASS on main PC |
 | Live signed AI path | Final packaged sidecar hash matched the installed sidecar; OpenAI-compatible request `chatcmpl-019fc949a1937a1383f8537e4547ff9d` crossed signed owner mesh and returned a complete answer with no `</think>` trace | PASS on main PC |
 | AI evidence | Hash-chain events 43507 and 43521 are the matching `model.session.lease.issued` and `model.session.receipted` records for session `019fc949-a193-7a13-83f8-536abd780b5a` | PASS |
@@ -25,18 +25,24 @@ Release channel: **`v0.2.3-fabric-proof.1`**
 
 The final packaged worker evidence directory was
 `output/worker-desktop-smoke-69d4b82cf2384b00a827f3d26a3f9b63`. The final installer evidence
-directory was `output/nsis-install-f5d85a7530f44626a62e9f4fb6e2b44d`. These are local process
-evidence paths, not portable release assets.
+directory for the source-identical local package was
+`output/nsis-install-f5d85a7530f44626a62e9f4fb6e2b44d`. The exact tagged CI-built NSIS was then
+downloaded from the draft release, independently matched to its generated checksum manifest, and
+passed the same lifecycle campaign in `output/nsis-install-df345c3b840f434d8221250c4563b2aa`.
+These are local process evidence paths, not portable release assets.
 
 ## Release artifacts
 
-| Artifact | Bytes | SHA-256 | Authenticode |
-| --- | ---: | --- | --- |
-| `Rampage_0.2.3_x64-setup.exe` | 69,200,646 | `015cb0172ac655a6e1ab7a278481c67092a9bd591577bc32a2c7930536b41f34` | Not signed |
-| `Rampage_0.2.3_x64_en-US.msi` | 79,060,992 | `0a5a6ecba49d3c5b3e5123d7b6c2266c5e44e9f8a7eec4483b502180edf30ed1` | Not signed |
+| Artifact | Bytes | SHA-256 | GitHub provenance | Authenticode |
+| --- | ---: | --- | --- | --- |
+| `Rampage_0.2.3_x64-setup.exe` | 68,932,326 | `5790b322d2ed6b6694af8837bf85233e947bcf049fcde6d6248bfbd130ac21a0` | Attested from tag workflow | Not signed |
+| `Rampage_0.2.3_x64_en-US.msi` | 78,749,696 | `f734cbbb893e03f0a590a5ccaf1858123f8f8e12b2c7248d52084e9c5536df04` | Attested from tag workflow | Not signed |
 
-The checksums are duplicated in [`SHA256SUMS-0.2.3.txt`](SHA256SUMS-0.2.3.txt) and must match the
-assets attached to the GitHub prerelease.
+The checksums are duplicated in [`SHA256SUMS-0.2.3.txt`](SHA256SUMS-0.2.3.txt), match the generated
+`SHA256SUMS-windows-x64` release asset, and identify the files attached to the GitHub prerelease.
+Native package bytes are not claimed to be reproducible across the local and clean CI build
+environments; the live Qwen and signed benchmark proofs used the source-identical local candidate,
+while the exact public NSIS separately passed the packaged-owner install lifecycle above.
 
 ## Physical campaign boundary
 
@@ -45,8 +51,9 @@ assets attached to the GitHub prerelease.
 - Consequently, the final two-node 0.2.3 sustained benchmark, the repaired 16 MiB storage campaign,
   laptop-local Ollama qualification, and post-controller-restart physical reconnection remain the
   next interactive gate after one laptop installer run.
-- The main PC is installed from the exact final NSIS artifact and its signed local model and CPU
-  paths have passed.
+- The main PC is installed from the source-identical local 0.2.3 candidate, and its signed local
+  model and CPU paths have passed. The byte-distinct public CI NSIS separately passed installation,
+  packaged-owner startup, shortcut, shutdown, uninstall, and no-leak checks.
 - Phone installation and physical lifecycle qualification remain separate from the desktop fabric.
 - Windows 10, Authenticode reputation, macOS notarization, Linux stable packaging, and a deployed
   hard-NAT owner relay remain separate qualification gates.

docs/RELEASE_NOTES_0.2.3.md

@@ -47,16 +47,18 @@ inferring performance from hardware names.
 - The packaged worker passed enrollment, encrypted artifact round trip, signed benchmark,
   controller restart recovery, consumed-secret removal, pinned restart, close-to-tray, explicit
   exit, and no-sidecar-leak checks.
-- The NSIS candidate installed all six payloads, created the desktop and Rampage Shell shortcuts,
-  started the owner fabric, and removed the test installation cleanly.
+- The exact tagged CI-built NSIS matched its generated checksum manifest, installed all six
+  payloads, created the desktop and Rampage Shell shortcuts, started the owner fabric, and removed
+  the test installation cleanly with no leaked sidecars.
 
 ## Honest boundary
 
 This is an **unsigned Windows 11 x64 prerelease candidate**. Verify its published SHA-256 before
-running it. The main PC is on the exact 0.2.3 package; the already-enrolled physical laptop must be
-upgraded to this same build before its benchmark adapter, clock-skew fix, automatic local AI, and
-controller-restart recovery can be measured together. Phone qualification remains the next native
-device gate.
+running it. The main PC is on a source-identical local 0.2.3 proof package; the exact public CI NSIS
+separately passed its install, packaged-owner, shortcut, shutdown, uninstall, and no-leak campaign.
+The already-enrolled physical laptop must be upgraded to the public build before its benchmark
+adapter, clock-skew fix, automatic local AI, and controller-restart recovery can be measured
+together. Phone qualification remains the next native device gate.
 
 Rampage pools work, services, replicas, and encrypted artifacts. It does not make commodity network
 RAM or VRAM locally addressable, and unsafe llama.cpp RPC remains blocked.

docs/SHA256SUMS-0.2.3.txt

@@ -1,2 +1,2 @@
-015cb0172ac655a6e1ab7a278481c67092a9bd591577bc32a2c7930536b41f34 *Rampage_0.2.3_x64-setup.exe
-0a5a6ecba49d3c5b3e5123d7b6c2266c5e44e9f8a7eec4483b502180edf30ed1 *Rampage_0.2.3_x64_en-US.msi
+5790b322d2ed6b6694af8837bf85233e947bcf049fcde6d6248bfbd130ac21a0 *Rampage_0.2.3_x64-setup.exe
+f734cbbb893e03f0a590a5ccaf1858123f8f8e12b2c7248d52084e9c5536df04 *Rampage_0.2.3_x64_en-US.msi