file task 76: nothing owns provisioning

Five souveraine files own no package across the two live devices, and
/etc/systemd/system/souveraine-machined.service shadows the packaged
signer unit on both — measured, not inferred. Retires the Phase C deploy
checklist: CLAUDE.md banned its build step on 2026-07-24, START-HERE §5
bans its deploy step.

docs/tasks/README.md

@@ -100,6 +100,7 @@ Four that are cheap relative to what they unblock:
 | 23 | [culver locked-notification nudge](23-culver-locked-notification-nudge.md) | Needs `SyncBurst()` + an IdleCoordinator schedule (TASK-15). |
 | 24 | [Keyboard layout rethink](24-keyboard-layout-rethink.md) | Superseded by TASK-17's reference-led Daily/Terminal Squeekboard layouts. Retained as design evidence; do not resume its Stevia patch plan. |
 | 27 | [Gitea pipeline audit](27-gitea-pipeline-audit.md) | The fixes. Overlay is not a package; no `primary` branch; poisoned build sysroot. |
+| 76 | [Provisioning belongs to a package](76-provisioning-by-package.md) | Five hand-placed files own no package on the two live devices, and `/etc/systemd/system/souveraine-machined.service` shadows the packaged signer unit on **both**. Activation is two unversioned lua lines. `blueline-edge-sense` already ships the correct `.wants` pattern. |
 | 32 | [Pill and keyboard as owned apps](32-pill-and-osk-as-apps.md) | Keyboard now has one runtime/package owner and no dual-OSK provisioning; glass proof remains. Pill ownership and package-owned shell delivery remain open. |
 | 33 | [Battery belongs to the state machine](33-battery-as-device-state.md) | Last raw feed going straight to the glass. The charge ceiling is writable today. |
 | 37 | ["Back" as a first-class verb](37-navigation-back-verb.md) | Our `Gestures.qml` is already the compositor half; `can_go_back` is the dial's enabled/reason. |