Bind release candidate verification to a complete artifact inventory #516

🤖 Generated by the Agentic Engineer

Problem and evidence

Marketplace verification trusts a successful but incomplete filesystem inventory. A controlled observer emitting an empty inventory lets the real verifier accept a candidate directory with an additional linked entry, while the complete native inventory correctly rejects it.

Expected outcome

Candidate verification must independently establish the complete expected artifact entries and their regular file boundaries. A plausible empty or partial inventory cannot prove that unexamined entries are absent.

Acceptance criteria

• Reproduce the incorrect VERIFIED result through the actual verifier.
• Bind the observed candidate directory to the expected complete entry set.
• Reject extra entries, linked intermediate directories and failed or incomplete observations.
• Preserve valid candidate verification and read-only caller behavior.
• Run preparation, verification and historical inspection regression suites.

Rough size: S. Part of #101.