🐛 fix(ci): run the orphaned release-verify-test gate (D-159)

CHANGELOG.md

@@ -92,6 +92,7 @@ repository still gets a decision, never by following the link; no release carrie
 - :memo: docs(e11): Shape D justifies E11 unconditionally — an encoded adjacency CEL cannot decode (F01)
 - :memo: docs(e11): Shape D rests on no-recursion alone — the decode barrier was false (F-01)
 - :memo: docs(e11): delete the false cost claim; reason 1 carries Shape D alone (F3-01)
+- :memo: docs(ci): D-159 recorded a residual that does not exist (ORPH-01..04)
 
 ### Features
 - :sparkles: feat(audit): measure REL-03/REL-07 by real mutation run, not by name
@@ -127,6 +128,7 @@ repository still gets a decision, never by following the link; no release carrie
 - :white_check_mark: test(hack): gate that hack/** bash 4+ features declare a floor (BASH32-F01)
 - :white_check_mark: test(hack): the bash-3.2-clean assertion could not fail (BASH32-F01)
 - :white_check_mark: test(hack): close two gate fail-opens found by review (BASH32-F01)
+- :white_check_mark: test(ci): wire release-verify-test into task check (D-159)
 ## [0.3.0] - 2026-08-18
 
 ### Chores

Taskfile.yml

@@ -122,6 +122,18 @@ tasks:
       # without this line an unpinned `cosign verify-blob` ships silently again,
       # and SECURITY.md's published issuer/identity pair can drift away from it.
       - task: release-install-cosign-pin-test
+      # ORPHAN / D-159: `release-verify-test` is the ONLY test of
+      # hack/release/verify-artifacts.sh — the checksum/version/cosign procedure
+      # SECURITY.md:61 publishes to release consumers — and it was invoked by
+      # nothing: not check:, not CHECK_STAGES, not the push-only release-exitgate.
+      # A gate invoked by nothing is not a gate (D-124). Placed with the other
+      # release-gate rows; position is not load-bearing (this stage reads no build
+      # output and nothing downstream reads its output), unlike dogfood-examples,
+      # which must follow build. Its `readme` mode covers hack/release/README.md,
+      # which docs-gates does not read at all — so that file's only pin is here.
+      # Offline in the three modes wired above; see the task definition for why
+      # mode `all` is not.
+      - task: release-verify-test
       # D-124: the AUD-S06 docs truth-lag gates shipped green and invoked by nothing,
       # which is the same manual-gate defect they exist to close. Sequential (not a
       # `deps:` entry) — go-task runs deps in parallel and readme_smoke_test.sh builds
@@ -290,10 +302,24 @@ tasks:
     cmds:
       - bash hack/release/verify-artifacts.sh
 
+  # ORPHAN / D-159: the three OFFLINE modes, named one per line so each is
+  # separately pinned in the exit gate's STAGE_BODY_PINS. The bare
+  # `bash hack/release/verify_test.sh` this task used to run means mode `all`,
+  # which adds test_snapshot_pass -> `task release-snapshot`: `go install
+  # goreleaser@…` on any machine without it (network), a `go mod tidy` before-hook
+  # that rewrites go.mod/go.sum in the middle of `task check`, `--clean` on the
+  # developer's dist/, and a five-target cross-compile. None of that belongs in a
+  # per-commit gate, so REQ-E9-S12-01 stays where the spec already puts it —
+  # `task release-snapshot && task release-verify`, an L1 release-time step.
+  # What runs here is REQ-E9-S12-02/03/04: the tamper rejection, the cosign
+  # skip-when-absent path, and the README pin. All three are offline and finish
+  # in well under a second.
   release-verify-test:
-    desc: "Verify artifact harness gates (REQ-E9-S12-01..03)"
+    desc: "Verify artifact harness gates, offline modes (REQ-E9-S12-02/03/04)"
     cmds:
-      - bash hack/release/verify_test.sh
+      - bash hack/release/verify_test.sh negative
+      - bash hack/release/verify_test.sh cosign-skip-when-absent
+      - bash hack/release/verify_test.sh readme
 
   release-changelog-gate-test:
     desc: "AUD-S02 gate: the CHANGELOG drift gate is wired and fires (REQ-AUD-S02-01/02)"