Assemble evidence-bound release submission package

[worldofhacks]

Pre-release submission and compliance package bound to retained evidence rather than prose.

Includes:

• complete ATO packet and labeled tabletop incident/postmortem
• content hash manifest and release-binding ledger
• cost-input ledger that distinguishes reservation from measured spend
• reconciled requirements, architecture, threat model, demo, and social draft
• integrity tests that quarantine unsupported historical claims

Validation:

• Ruff 0.16 lint and format green
• ATO SHA-256 manifest verified 9 of 9
• 199 targeted contract, authorization, lineage, and documentation tests passed
• corpus inventory remains explicitly pre-release

Release fields for exact SHA, deployments, governed run, invoice export, and measured cost remain intentionally pending and must be filled from immutable final artifacts. This PR is draft pending independent evidence review and the assembled release candidate.