feat(helper): accept dormant mutation envelopes

Cut 2 adds a verify-envelope path beside the closure-token executor. The helper parses an envelope, binds it to the independently provisioned agent identity, validates time and lifetime bounds, selects the trusted key, verifies the signed contract, checks backend payload shape, and then refuses with backend_not_migrated.

Every path emits an unsigned MutationReceipt. No backend executes, no replay slot is consumed, and no artifact-custody claim is made until the first existing backend migrates.

protocol/README.md

@@ -208,4 +208,21 @@ still produces a receipt, and its emptiness is part of the record.
 - tamper refusal for provenance, execution location, target, backend, resolved action,
   authorization metadata, decision, time window, and unknown formats.
 
-Go tests live in both capability packages. Rust tests live in `helper/src/mutation_protocol.rs`.
+Go tests live in both capability packages. Rust tests live in
+`helper/src/mutation_protocol.rs`, and the helper's own envelope-path tests live in
+`helper/src/main.rs`.
+
+## Executor status
+
+`redflag-helper verify-envelope --envelope-file <path> [--receipt-file <path>]` verifies an
+envelope through the helper's real pipeline — parse, host binding, trusted keyring,
+signature, time, lifetime ceiling, backend payload shape — and then refuses with
+`backend_not_migrated`, because no backend executes through this path yet.
+
+It records **no replay state**. Execute mode records a token only after a plan is built, so
+an operation that cannot run never burns its slot; nothing here can run, so nothing here
+records. Replay identity stays unproven until the first backend migrates.
+
+It also enforces no artifact custody. When a backend carries a local cached artifact as
+executor input, the helper must rehash it before use. Remote repository execution keeps the
+limits `RAF/security/05-supply-chain-gate.md` already states.