projection: bind the restored source boundary

Every current admitted path now matches the integrated source tree exactly.

Source-Sha: 9e49fdae916343feae29da254663474901d9b97e
Policy-Sha: 9e49fdae916343feae29da254663474901d9b97e
Tree-Digest: bcb4e35a0337aded0f27e77a3738a8356afcf7243ce3510c51e4d1684ebc298b

.gitea/workflows/desktop-windows.yml

@@ -2,10 +2,6 @@ name: desktop-windows
 on:
   workflow_dispatch:
     inputs:
-      runner:
-        description: Native Windows runner label with Qt 6, MSVC, Rust, Go and Node
-        required: true
-        default: windows-desktop
       version:
         description: Desktop version matching the checked-out Cargo crate (three or four parts)
         required: true
@@ -16,7 +12,9 @@ permissions:
 
 jobs:
   desktop:
-    runs-on: ${{ github.event.inputs.runner }}
+    # windows-build is the commissioned native lane. Move this to
+    # windows-desktop only after that narrower toolchain is installed and proved.
+    runs-on: windows-build
     defaults:
       run:
         shell: powershell

.gitignore

@@ -306,6 +306,9 @@ server/scripts/
 *.deb
 *.snap
 
+# Python bytecode — the gate and the installers compile beside their source
+__pycache__/
+
 # Documentation build
 docs/_build/
 docs/build/

README.md

@@ -101,6 +101,12 @@ curl -sfL -H "X-Registration-Token: your-token" "https://your-server.com/api/v1/
 ```
 
 **Windows:**
+
+Run elevated Windows PowerShell with an operator-installed OpenSSL 3 executable
+on `PATH` (`Get-Command openssl`). The installer checks Ed25519 acceptance and
+rejection before changing the agent. Missing verification support, unsigned or
+invalid signatures, and manifest hash mismatches stop installation. Installing
+PowerShell 7 alone does not supply this verifier.
 ```powershell
 iwr -Headers @{"X-Registration-Token"="your-token"} "https://your-server.com/api/v1/install/windows" | iex
 ```