ci: split PR and release certification gates (#161)

docs/PULL_REQUEST_DELIVERY.md

@@ -39,14 +39,17 @@ both human contributors and coding agents.
 
 4. Run the smallest meaningful verification set.
 
-   For most code changes:
+   For most code changes, run the same correctness gate used by CI:
 
    ```bash
-   npm run typecheck
-   npm test
-   npm run doctor
+   npm run test:pr
    ```
 
+   CI additionally measures changed executable lines against the PR base and
+   requires at least 50% coverage. This permits incremental review without
+   claiming release certification. Release tags rerun the complete coverage,
+   evidence, anti-fitting, smoke, build, audit, and package gates.
+
    For docs-only changes, note why code tests were skipped. For UI-only
    `docs/index.html` changes, extract or otherwise parse-check the page scripts.
    For benchmark or headline-claim changes, also run:

docs/RELEASE_CHECKLIST.md

@@ -67,12 +67,14 @@ degrade gracefully — they never fail the core run.
   ```
 - Tag the release only after Sections 1–2 are green.
 - Push the `v*` tag and wait for the tag workflow. It reruns
-  `npm run test:release`, the high-severity dependency audit, and the package
-  dry run against the exact tag, then retains the tested `.tgz`, its manifest,
-  and `SHA256SUMS` as workflow artifacts.
-- Inspect `pack-result.json`: only the allowlisted runtime, scripts, tools,
-  documentation, examples, and package metadata may ship. Workspace notes,
-  tests, AIWG/provider deployment internals, secrets, and local artifacts are
-  release blockers.
-- Publish the retained, checksum-matched package artifact. Do not rebuild a
-  different archive from another checkout after certification.
+  `npm run test:release`, the high-severity dependency audit, and package dry
+  run against the exact tag. It then creates one deterministic
+  `T3MP3ST-<sha>.zip` directly from that tested Git object.
+- The workflow extracts that ZIP into a clean temporary directory, performs a
+  locked install and build, and invokes the packaged CLI help path before the
+  archive can be retained.
+- Verify `release-evidence/source-zip-check.txt`, `SHA256SUMS`, and the retained
+  Sigstore provenance bundle. Workspace notes, secrets, ignored files, and
+  local artifacts cannot enter a `git archive` snapshot.
+- Publish the retained, checksum-matched ZIP. Do not rebuild a different
+  archive from another checkout after certification.