Prove the released artifact works on a machine that never built it

[iderex]

Everything else in this milestone is checked on a machine that has the source,
the toolchain and the caches. An operator has none of those. The gap between
those two machines is where a missing runtime dependency, a wrong architecture,
or an artifact that was never actually in the archive is discovered, and it is
usually discovered by the operator.

What this produces

A verification run on a clean machine with no toolchain and no source, that
downloads the published artifact, verifies its checksum and its provenance from
#87, runs the probe from #92 against a server, and fails if any step does not
work.

The same run on each platform family the release claims to support, since an
artifact that works on one is no evidence about another.

An honest statement of which platform families are not verified this way and why,
so that a green run cannot be read as covering all of them.

Done when

The verification runs on a clean machine per claimed platform family, a
deliberately corrupted artifact fails it, the unverified families are named in
the run output, and a release cannot be marked ready until it has passed.
Blocked on #87, #92, #94.

[iderex]

Three of the conditions here rest on a set, a disclosure and a state that nothing
on this board declares, and all three are readable before any of what this issue
waits on exists.

The run iterates over a set with no source. The condition asks for a clean
machine per claimed platform family, and the issues this one names are:

gh api repos/Flowfin/core/issues/97 --jq '.body' | grep -o '#[0-9]\+' | sort -u | tr '\n' ' '
#87 #92 #94

None of those three decides a platform set. The one issue that decides one is
#113, and what it decides is a different set:

gh api repos/Flowfin/core/issues/113 --jq '.body' | tr '\n' ' ' | tr -s ' ' | grep -o 'The set of platforms[^.]*\.'
The set of platforms the `build` and `test` checks run on, each with the reason it is there rather than a list that grew.

That is what the gate compiles and tests on. What a release claims to support is
not the same list, and #91, which records what the first release contains, names a
platform once and only to say that no client for one is in it:

gh api repos/Flowfin/core/issues/91 --jq '.body' | grep -icE 'platform'
1

So the word claimed in the condition above resolves to nothing today, and the
number of machines the run covers would be decided by whoever writes it.

The second is one negative disclosure with two homes. This issue owes it and #113
owes it:

gh api repos/Flowfin/core/issues/97 --jq '.body' | tr '\n' ' ' | tr -s ' ' | grep -o 'An honest statement[^.]*\.'
An honest statement of which platform families are not verified this way and why, so that a green run cannot be read as covering all of them.
gh api repos/Flowfin/core/issues/113 --jq '.body' | tr '\n' ' ' | tr -s ' ' | grep -o 'The platforms nothing covers[^.]*\.'
The platforms nothing covers, named in the same place, so that a client author reads what was not tested instead of assuming the silence means it passed.

One is a document a client author reads and the other is a run's output, so both
are wanted and neither is redundant. What neither issue says is that the second to
land names the first rather than restating it. A negative written out twice drifts
in one direction only, which is towards reading as coverage that was never there.

The third is a state nothing creates. The condition ends by saying a release
cannot be marked ready until this has passed, and marking a release ready appears
in no other issue on this board:

gh issue list --repo Flowfin/core --state all --limit 500 --json number,body --jq '.[] | select(.body | test("marked ready|mark a release ready|release ready")) | .number'
97

#96 runs the full gate before a tag publishes, and #91 records what the first
release contains. Neither produces a readiness state that a failing run could
withhold, so that clause is met by nothing and refused by nothing as the board
stands.

I have changed no condition and no scope. Nothing above is a measurement of an
artifact, because this repository has published none:

gh api repos/Flowfin/core/releases --jq 'length'
0