[madhavkhoslaa]

Summary

• Verify the signed exact ZIP locally before the publish network request.
• Block real experimental chunk uploads until the protocol supports signed attestations. Dry runs remain available.
• Sync the embedded assistant guide and CLI LLM docs.

Checks

• go build ./..., go vet ./..., go test ./...
• Embedded guide matches the updated handbook source.

Deploy the matching infra gate after this CLI release succeeds.