[echoomegaprime]

Why

The deployed CertForge directory provider consumes independently signed production E2E envelopes, but the owner installation path had no reusable executable that verified the exact canonical run identity before publishing or replacing a file.

Changes

• Restore the actual deployed d8ad9fd production_e2e.py contract byte-for-byte, with its existing tests, because the PR43 base lacks that provider module.
• Add an owner-operated verification/atomic intake entrypoint with independent pinned public trust, exact target/environment/source/deployment and freshness checks, protected POSIX roots, bounded parsing, no-follow file access, a nonblocking lock, explicit previous-file hash comparison, fsync/rename/readback, and idempotent reconciliation.
• Preserve unknown outcomes after a publication or cleanup/durability error. Reconciliation establishes file/directory durability before reporting already_present.
• Document candidate qualification before promotion and the existing signing-custody boundary. No private key, key enrollment, trust root, release rule, dispatcher, service or production envelope is changed.

Validation

• Linux full suite: 702 passed, 1 skipped; unchanged coverage requirement passed at 80.11%.
• Focused signature/provider/intake tests: 41 passed on Linux; 30 passed and 11 POSIX-only cases skipped on native Windows.
• P1 acceptance passed on Linux and native Windows.
• Independent review found two durability edge cases; both were fixed with failing-then-passing fault-injection tests.
• Native full suite was also attempted and retained. Existing Linux /proc/getuid fixtures, Windows symlink privilege restrictions and an existing HTTP cleanup failure prevent a full Windows pass. The new oversized-input test's overlong generated pytest ID was corrected without changing its assertion.

Release boundary

This is source implementation, not production activation. A real admitted collector and protected signing-custody invocation are still required to produce a trusted envelope. Intake reports NOT_ISSUED for the release verdict. This PR is stacked on PR43; its observer is unchanged.