deploy(hf): sync szl-holdings/a11oy@75ca0315c78d48e03cb290bebc85dabd196ea4d1 derived COPY set

Reusable Dockerfile-COPY-derived deploy from szl-holdings/a11oy 75ca0315c78d48e03cb290bebc85dabd196ea4d1.
Files: 1179 Pruned: 0
Derived from Dockerfile COPY sources (NO hand-maintained allowlist).

Signed-off-by: SZL Holdings <noreply@szlholdings.ai>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README.md

@@ -189,17 +189,21 @@ python3 .github/shared-module-hash-check.py --update
 
 ## Governed Delta Workspace
 
-> Runtime status: `UNAVAILABLE`. The GDW operational routes are intentionally
-> fail-closed while the Wave 26 and Wave 28 implementations are consolidated
-> behind one authenticated, owner-bound, doctrine-gated contract with durable
-> receipt/proof publication semantics. Health remains available; state,
-> telemetry, benchmark metadata, integrity, and step routes return HTTP 503
-> without creating artifacts.
+> Runtime write status is configuration-bound. GDW reports `REAL` only when its
+> secret-managed credential registry, canonical governance gates, verified
+> persistent storage, exact schema, and a fresh generation-bound supervised
+> outbox pass are ready.
+> Otherwise it reports `UNAVAILABLE` and writes fail closed.
+>
+> The public deployment remains `UNAVAILABLE` until this corrective source is
+> protected-merged, exact-source relocked, and the production credential and
+> persistence contracts are observed live. Source tests are not deployment
+> evidence.
 
 > GDW Frontier Push Pack is a MODELED instrumentation and verification extension for the Governed Delta Workspace. It provides load testing, operator validation, hybrid scheduling research hooks, KDA-vs-MLA memory benchmarking, and Lean-oriented proof export. It does not claim frontier benchmark superiority, proprietary activation access, or production-scale guarantees beyond the measured harness outputs.
 
-The contained runtime, Postman collection, load tools, offline dashboard, memory
-benchmark, proof-input bridge, and the conditions for restoring service are documented in
+The authenticated runtime, Postman collection, load tools, offline dashboard,
+memory benchmark, proof-input bridge, and fail-closed readiness conditions are documented in
 [`docs/gdw-frontier.md`](docs/gdw-frontier.md). A checked theorem is reported
 separately from an exported theorem input, and every throughput result is scoped
 to its captured run.

policy/colang/enforcement-contract.json

@@ -0,0 +1,8 @@
+{
+  "schema": "szl.colang-enforcement-contract/v1",
+  "evaluator_region_sha256": "f0ced8c0aaed4850f65bfa9d14e43c5a283e457de26b2ef1e3999383d653fc42",
+  "policy_files": {
+    "killinchu_threat.co": "3c47dfd730d738f1ce0b722b5ccc21fb12dda70ccb288043ffe10b78479df9c2",
+    "roe_core.co": "77598deb89c4bebeb3682b30a0a01fcebc73a089183fa0a9a2877ad1fd732984"
+  }
+}