perf(proof): pipeline protected work with signed harness identities

[drewstone]

Change

Pipeline independent protected proof work inside one certified account census epoch, with a fixed four-resource admission budget and an atomic stress pair.
Keep all seven independent before/after census scopes, nine exact owned identities, cleanup checks and exclusive LIVE-10.
The default remains OFF.

Add a separate protected speed workflow that verifies both signed identities before admission.
The application remains the public 0.3.2 archive 476307aa and original signed b5 candidate 36294457062.
The current main harness requires a separate signed publish=false candidate.
The original b5 canonical six-row verifier remains mandatory.
Both cloud workflows share one concurrency group.

Proof

• Existing live reference: 827 → 683 seconds, one observation per configuration.
• Scheduler: 170/170 focused checks and full verification passed; one regression follows the reproduced duplicate-admission bug.
• Independent exact-head audit: zero remaining P1/P2; 464 frozen records match.
• Wrapper: original signed/public archive, 2,096 restored files and frozen dependency inputs verified without rebuilding.
• Actual seven-field configuration regression: 1/1; syntax, formatting and workflow validation passed.
• Integrated final full check and PR CI are running.

No current-harness signed candidate or new pipeline live wall exists.
The budgeted projection remains unknown; the target is below 300 seconds.
This PR changes private proof tooling and does not publish a package.

Rollout and release coordination

Keep OFF until a signed dual-identity preflight and internal fixed-gate live proof pass.
Then stage internal → 1% → broad with full-wall validation and rollback to OFF.
Root holds this PR's merge while the 0.3.3 release preparation binds main afc8380e.
The running 0.3.3 protected run is 36297994978; installed analysis uses that separate signed 0.3.3 archive.
Do not overlap admissions on the shared cloud proof account.

[tangletools]

✅ Auto-approved PR — 9c3c4138

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-09-27T05:49:21Z}