fix(ci): qualify first release hardening

[f0rr0]

Purpose

Qualification-only transport for the first-release hardening tree. Do not merge this PR.

This branch exists only so GitHub can exercise the complete release matrix against one immutable candidate. No history repair or publication is authorized by this PR.

Exact Q15 candidate

• Signed commit: 03c0520c5aca5172d0f28b26cc6beff9f03cc1cb
• Tree: 09bb4386242c27251e5b8da11df0d4e4803a3018
• Sole parent / unchanged main: 06816d377f96ab8e53d3c6ec8732577cc4386f2e
• Signature: GitHub verified, reason valid, signer sid_26@outlook.com
• Hosted proof: https://github.com/f0rr0/oliphaunt/actions/runs/29641774347

Failure-class closure

• macOS: embedded ProcSignal delivery is synchronous and cannot overwrite or signal the Node host SIGUSR1 handler; the exact candidate carries a behavioral host sentinel.
• Windows: embedded modules are built with oliphaunt.dll as their backend provider. Every normal and delay-loaded postgres.exe import is rejected. PL/pgSQL must import oliphaunt.dll as the positive provider canary; demand-linked modules may omit an unused provider import, with that classification recorded in the v2 artifact evidence.
• iOS: CocoaPods receives only the exact outer liboliphaunt.xcframework, never nested slice frameworks.
• Android: the full Expo release build has an explicit 6 GiB heap, 1536 MiB metaspace ceiling, and two-worker bound with validated overrides.

Q14 proved every independent producer except the Windows extension artifact row. That row built all 38 selected DLLs and then exposed an over-strict audit: earthdistance.dll legitimately has no backend-provider import because it resolves no backend symbols. Q15 corrects the invariant without weakening the postgres.exe rejection.

Local proof for this exact tree

• Aggregate release gate: 982 pass, 10 platform-inapplicable skips, 0 failures across 149 files and 14,439 assertions; repeated after the final evidence-schema naming correction.
• Windows/PE focused suite: 37 pass, 0 failures, including direct and delay-loaded postgres.exe regressions.
• Required asset verification and extension-model checks passed.
• SDK contracts, native patch-stack checks, and React Native build/typecheck/codegen passed (18 Moon tasks).
• Pre-commit hooks, Cargo formatting, JavaScript syntax, generated semantic fingerprints, strict patch application, and diff hygiene passed.
• Independent audit parsed every Q13 Windows exact-extension DLL: 37 required the standalone backend and earthdistance.dll alone was provider-import-free; Q15 uses the scalable linker-semantic rule and PL/pgSQL canary rather than a module allowlist.

The protected-main repair and all publication actions remain separate, explicitly approved operations after this exact SHA reaches Qualified.