Require signed production E2E before readiness

[echoomegaprime]

Summary

Adds CertForge 1.2.0 production-E2E evidence as an engine invariant. A verdict cannot be PRODUCTION_READY without a fresh pinned-key Ed25519 attestation bound to the exact source SHA, deployment SHA, target identity, environment identity, required checks, and signed envelope. Adds the strict Echo GitHub Autonomy profile for the canonical 30-tool, four-account, public/private, upstream-reconciled, four-client service.

Why

Commander directive: Certification Forge must never issue a green certificate before the entire production journey is complete end to end. Source-only checks, successful exits, and reachable URLs are insufficient.

Validation

.\.venv\Scripts\python.exe -m pytest -q
637 passed, 3 skipped, 1 warning

.\.venv\Scripts\python.exe scripts\p1_acceptance.py
passed=true; default/source-only/tamper paths remain NOT_READY

.\.venv\Scripts\python.exe scripts\certification_journey.py
apps=8/8; capabilities=60; certificate_renderer=PASS; compiled_modules=57; version=1.2.0

git diff --cached --binary | gitleaks stdin --no-banner --redact --exit-code 1
no leaks found (82.72 KB)

Live production E2E not run: this issuer change must deploy before it can verify the Autonomy deployment.

Security

Collector keys are independently pinned server-side; target-controlled public keys are rejected. Raw dictionaries cannot satisfy the executor type boundary. GitHub App credentials remain preferred, Vault user-token fallback is permitted only server-side, and model/client-config credentials or secret exposure fail the Autonomy profile. No database migration. Rollback is deployment of parent commit 153ee6b.

Evidence

Commit: 8a6e10d
Branch: agent/e2e-verdict-gate
Certification Forge: not run - live E2E prerequisite intentionally not yet satisfied
Release Sentinel: not run - review branch only
CodeQL: pending hosted checks on this exact SHA