Deliver Risk Scorer guidance on necessary verification #548

Owner: @tompahoward-agent. Revision: 1, independently reviewed. Source work and local checks are complete in #549. Integration and publication await required main CI. Local and applicable cloud verification follow publication.

Update the pipeline reviewer and release assessment guidance so the caller runs scorer-directed controls, reuses equivalent evidence, and reassesses outstanding checks on material evidence changes. A necessary unavailable test leaves the action on hold with the risk, score, control, and execution limitation. An obsolete checklist item adds no hold. Keep required checks, authority and score contracts intact.

Acceptance: paired behavioural cases demonstrate both outcomes, normal CI qualifies the release, stable publication is verified, and the released version and behaviour are verified locally and in applicable Codex Cloud environments.

The implementation, publication and environment verification are bounded contributions. Keep existing Architect work with its current owner. A related release can share publication only if each package has independent qualification and the release scope is verified.

Developers benefit when release assessments explain the specific evidence they still need and retire tests whose justification has been resolved. The Risk Scorer contributor updates the reviewer and release guidance and runs the two behavioural cases. The increment owner verifies which cloud environments use the plugin before installation. The separate Architect contribution continues with its existing owner.

A superseded checklist test does not hold an otherwise qualified action. A still-needed unavailable test holds it and reports the risk, score, needed test, and reason it cannot run.

Sequence: guidance and evals, then required CI and stable publication, then local and cloud verification in parallel where available. No refactor is planned. Clean up temporary test and packaging state before acceptance. Inspect the saved cloud configurations and their supported installation paths before attempting installation. Record the released version, behaviour and any unresolved limitation for each applicable environment.