fix(release,guard): a short release cannot be signed; withdraw a false claim

[avrabe]

Batch 1 of the multi-persona review of REQ-GUARD-GATE-EVIDENCE-002 — the three
changes that need no design debate. Refs #402, #405.

Four independent reviewers (safety assessor, adversarial verifier, defect
archaeologist, release manager) all recommended holding -002 at proposed.
This PR takes the uncontested subset; the two live obligation holes (#404, #385)
and the systemic layer (#403, #405, #406) follow separately.

1. release.yml can no longer publish a signed release with no binaries (#402)

find … -exec cp exits 0 when it matches nothing, and all six upstream
upload-artifact steps sat at the default if-no-files-found: warn. An empty or
partial artifacts/ therefore produced an empty release-assets/ in silence —
and sha256sum, the SLSA attestation, cosign, and gh release create all
succeed over nothing. The result is a signed, attested release containing no
binaries.

The gather is now counted against a floor, which is the shape the SBOM block
ten lines below already used — the pattern was recognised once and not applied
to its five siblings. The floor is derived, not guessed: build-binaries has 5
matrix targets and build-vsix has 5, so a complete release carries at least 10
of these three extensions before wasm/compliance/evidence are counted.

All six uploads now declare if-no-files-found: error — the value
trace-fixtures.yml:453 already uses, so the repo demonstrably knew the
difference.

release.yml only runs on tags, so CI will never exercise this. The logic
was therefore exercised locally against four trees:

artifacts present	exit
0 — the #402 scenario	1
4 — partial build	1
10 — complete release	0
13 — complete + extras	0

The pre-fix form exits 0 on all four.

2. ci.yml's mutants comment no longer contradicts the gate it calls

It still read "Nothing here yet fails a truncated run: that detector, and the
runner disk-pressure fault behind it, are #389" — false since #401 merged two
commits earlier. This is precisely the "code drifted out from under its comment"
species that #385's own fix narrative identifies as its root cause, so leaving it
would be leaving the same trap re-armed.

The replacement also fixes the attribution. The disk-pressure hook was a red
herring — ACTIONS_RUNNER_HOOK_JOB_COMPLETED only runs between jobs. The
actual reaper was a tmpfiles sweep on a false premise: "a job that's still
running keeps mtime fresh", which does not hold for cargo-mutants, since it
copies each worker's source tree once at start and never touches it again.

3. A false universal in the requirement is withdrawn (#405)

I wrote this into REQ-GUARD-GATE-EVIDENCE-002 in #401:

"Each ships a self-test that runs BEFORE the gate it guards is allowed to judge
anything, and each was mutation-tested to show its cases are load-bearing
rather than merely green."

It is not true. Results exist for two of six, both manual shell runs with no
committed harness. An adversarial reviewer falsified the universal directly, and
I reproduced both mutants before writing this:

check_verification_filters.py:212   filt → filt.split('::')[-1]   13 passed → SURVIVES
check_lean_sorries.py               below-floor branch deleted     8 passed → SURVIVES

Mutant A is not cosmetic: 16 of the 60 distinct filters in
verification.yaml contain ::, and no self-test case has one, so the suite is
structurally blind to it.

The replacement text records the correlation rather than burying it: the two
tools that claimed mutation testing have the strongest suites; the two with live
holes (#404, #385) claimed nothing. The claim was reached for where confidence
was already high, which is where it adds least. It also states what mechanising
it (#405) would not buy — mutation testing shows the cases present are
load-bearing, not that the case set covers the hazard.

Not in this PR

REQ-GUARD-GATE-EVIDENCE-002 stays proposed and keeps its human-scoped tag.
Nothing here promotes it.

🤖 Generated with Claude Code

[github-actions]

Rivet verification gate

✅ 20/20 passed

	count
Passed	20
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!