[P1] Package the final autonomous-security release and reviewer evidence

[TFT444]

Objective

Produce a reproducible release and evidence bundle from the final merged autonomous-security commit so reviewers do not confuse historical v0.1.0-demo artifacts with the current implementation.

Audit finding

The tracked manifest is intentionally tied to commit dd0a157, while the local untracked wheel predates the autonomous API, runner, isolated signer, RPC verifier, and security-proof modules. The historical artifact is valid for its frozen source but cannot represent the new stack.

Depends on merging PRs #36-#40 and the final state of #34/#35.

Scope

• Build wheel and source distribution from a clean final checkout.
• Clean-install and run every shipped entry point.
• Generate fresh deterministic proof and visual evidence from that commit.
• Include real devnet evidence only if [P0] Complete and confirm one autonomous x402 Solana devnet payment #34 genuinely passes; otherwise record not executed.
• Manifest paths, sizes, SHA-256 hashes, source commit, modes, commands, and computed claims.
• Preserve older evidence as explicitly historical.
• Publish one current reviewer status separating merged, simulated, sandbox, devnet, and unresolved work.

Acceptance criteria

• Wheel contains every console-entry-point module in pyproject.toml.
• Clean-install smoke tests cover all eight commands and the credential-free live failure path.
• Manifest matches exact source commit and all hashes verify.
• Counts, PR state, and integration claims are current.
• Historical and current evidence are visibly separated.
• No untracked dist file is cited as evidence.
• No simulated signature is represented as a Solana transaction.
• Recorded fallback comes from the same candidate.
• CI verifies package contents and clean installation.

Non-goals

PyPI publication, production-readiness claims, or replacing machine-readable proof with marketing.

Keywords

release-candidate reproducible-build clean-install evidence-manifest reviewer-brief