fix: gate live signal pairs on strict committed structure

[Pigbibi]

Summary

• Add a strict, consumer-compatible signal-pair structural validation path while preserving default legacy/schema-only examples and replay
• Bind the exact signal bytes to an integer-v2 manifest, with exact keys, matching metadata, safe policy, and timezone/expiry consistency
• Gate changes to the two canonical live paths in the existing read-only test job using committed Git objects: PR merge-base to head, or push before to head
• Reject one-sided updates, deletion, rename away, invalid comparison commits, worktree substitutions, symlinks, and invalid producer lineage

Proof boundary

Success is PAIR_STRUCTURE_VALID. Actual context bytes, model use, and producer-run provenance remain UNVERIFIED. A formatted input_digest or repository ancestor does not establish that a model used a real context bundle. Those are separate publication-review conditions.

Unrelated changes do not relabel or block the retained legacy pair. No live signal, manifest, theme data, provider workflow, publisher identity, or permissions change is included.

Verification

• Original baseline: 97 passed
• Targeted RED regressions before implementation: 10 expected failures
• Complete suite: 138 passed; rerun after rebasing onto approved theme PR55: 138 passed in 2.77s
• Four existing example CLI checks passed using local fixture files
• Synthetic signal schemas 1/2 pass both strict RSCP and the existing QAR contract/freshness check
• Whitespace checks clean
• Exact five frozen files only; base 32c4339 preserved
• Approved theme blob 3634d4a8c7d5d72c651b68bbf6fee296279d8ae4 and its original bytes are unchanged

Draft for exact-head required CI review. No collection, model request, dispatch, new credential, permission expansion, or merge was performed.