Close the release base-H5 receipt bypass; add explicit gate-failed pool opt-in with verdict carriage

[MaxGhenis]

Fixes #780.

What

Two halves that land together:

1. Containment — closes the bare-H5 receipt bypass. When --base-h5 identifies as a US multispine pool (sibling manifest with the pool artifact kind, or the H5's own embedded artifact-metadata row — so a bare-copied pool still self-identifies), the release builder now requires and authenticates the pool manifest through the designed loader seam instead of the generic single-year H5 path. A present-but-malformed identity row is a hard error, never a bypass. The same authentication applies to preflight_us_release_gates.py.
2. Explicit opt-in with verdict carriage. --allow-gate-failed-base-pool accepts an authenticated pool with status=gate_failed / simulation_ready=false and stamps the full agreement-gate verdict (gates sha256, failure count, failure digest, flag use) into the release manifest. Preflight surfaces the carried red verdict prominently but does not change its exit code for it — the publication decision stays human. Without the flag, the newly closed fail-closed behavior. The exact-k --pool-manifest arm remains simulation-ready-only.

Why

The by-origin battery has no locally observed pass on any build (all six 1% diagnostics and the 25% candidate are red), the live incumbent predates it, and the adversarial audit that found the bypass also showed several battery legs are infeasible or mis-referenced by design (#781, #782, #783). Publication policy: head-to-head clear win vs the live incumbent is the bar; the battery verdict travels as evidence. No battery bounds, tolerances, plans, or gate logic are touched by this PR.

Verification

• Full pytest, one process per shard: 7,454 passed, 83 skipped.
• Ruff clean; git diff --check clean.
• New regression coverage: bare/red pool without the flag refused (the test that would have caught the old behavior); flag-on acceptance with verdict carriage; preflight authentication and surfacing; exact-k arm unchanged.

Root PROGRESS.md/out.md are the build lane's session journals per repo convention (history, not state).

Provenance: implemented by a gpt-5.6-sol lane; reviewed (contracts, edge cases, preflight semantics) by Claude; direction ruled by Max 2026-08-26.

🤖 Generated with Claude Code