Pin normal Intel verification to c9 and require the default Pi-only qualified provider pack. Preserve the historical baseline diagnostic and all startup deadlines.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Pin the final source and profile, restore fresh Rust compilation with SDK provenance, and keep manual immutable-source checks independent.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep the rustup PATH alias instead of invoking its rustup-init target directly. Audit resolved target bytes and recheck them before invocation; add a regression reproducing symlink-based CLI dispatch.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Archive and verify the complete tested pack before startup checks. Make cleanup uncertainty sticky across test cases, retain scratch after interrupted launches, and enforce the reviewed 16 GiB seven-day artifact storage bound without truncation.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
