test(release): add var spine fixture smoke

[VelariumAI]

Summary

Adds RR-003, a local fixture-based VAR spine smoke readiness layer.

For this task, VAR means the local validation / audit / replay-style readiness spine:

• profile/config posture
• evidence assessment/receipt posture
• harness report/ref posture
• replay result/ref posture
• statelock check/paradox posture
• skillruntime lifecycle facade posture
• trace refs tying the above together

What changed

• Added RR-003 smoke script:
  • scripts/release_readiness/rr003_var_spine_smoke.sh
• Added RR-003 smoke test:
  • scripts/release_readiness/test_rr003_smoke.sh
• Added Go fixture support:
  • pkg/releasecheck/rr003_var_spine_test.go
• Integrated RR-003 into:
  • scripts/release_readiness/readiness.sh
• Updated release readiness docs:
  • docs/release/README.md
• Updated promotion manifest / allowlist for new managed files.

Operational posture

• Local and fixture-based.
• Does not call providers.
• Does not call network endpoints.
• Does not execute app tools.
• Does not create, move, or delete tags.
• Does not run release workflows.
• Does not publish releases.
• Does not modify runtime behavior.
• Does not modify vector/semantic-memory behavior.
• Does not modify private scanner artifacts.
• Does not modify private contracts.
• Does not start RR-004+ tooling.

RR-003 behavior

RR-003 simulates local operator-facing fixture flows.

Happy path:

• creates a local fixture candidate/artifact
• evaluates profile/evidence posture
• creates evidence assessment/records/receipt
• creates harness/replay/statelock refs
• feeds evidence into skillruntime stage/validate-style flow
• verifies trace/ref linkage
• emits operator-facing report lines

Negative paths:

• missing harness/replay/statelock evidence is surfaced as approval-required / warning posture
• vector_assert_truth is denied as authority and receipted

RR-003 writes reports to:

.local/release-readiness/rr003/

Current RR-003 recommendation:

RR003_PASS

Main readiness integration

readiness.sh now includes RR-003 and still returns:

NEEDS_RR_SUITE

because RR-004+ remain deferred.

It does not claim RC_READY or STABLE_READY.

Review status

Independent review verdict: APPROVE.

Review confirmed:

• coherent profile/evidence/harness/replay/statelock/skillruntime/trace linkage
• happy path is receipted and ref-linked
• negative paths do not silently allow unsafe behavior
• operator-facing fixture output is present
• no provider/network/tool/release/tag/workflow execution
• vector/semantic memory preserved
• no public attribution
• manifest in sync

Validation

• bash scripts/release_readiness/test_smoke.sh passed.
• bash scripts/release_readiness/test_rr002_smoke.sh passed.
• bash scripts/release_readiness/test_rr003_smoke.sh passed.
• bash scripts/release_readiness/rr002_cli_smoke.sh passed with RR002_INCOMPLETE.
• bash scripts/release_readiness/rr003_var_spine_smoke.sh passed with RR003_PASS.
• bash scripts/release_readiness/readiness.sh passed with NEEDS_RR_SUITE.
• bash scripts/check_promotion_manifest.sh passed with 911 / 911 managed files.
• go test ./pkg/releasecheck passed.
• Targeted package tests passed.
• go test ./... passed.
• go vet ./... passed.
• git diff --check passed.
• Private scanner finding zero_proofs_3 | reasoning/ classified as existing unrelated.

Deferred follow-ups

• RR-004 policy absence + statelock/paradox smoke.
• RR-005 vector/RAG/engram preservation smoke.
• RR-006 scripted user/operator session simulation.
• RR-007 final release report generator.