Use current-run certificate paths in workflows, add mixed-mode validation, and publish SIR v2.2 docs

[SDL-HQ]

Motivation

• Ensure the CI workflow uses the actual certificate produced by the current run for contract validation, signature verification, archiving, docs publication, and commit staging so non-passing or inconclusive runs cannot inadvertently republish historical passing proofs.
• Harden ingress-mode validation by adding an explicit mixed-mode rejection path and clearer rule metadata for multi-ingress requests.
• Bump the project to SIR v2.2 and publish new operator-facing documentation capturing evidence-perimeter semantics and a public backlog of known hardening items.

Description

• Updated .github/workflows/audit-and-sign.yml, .github/workflows/r1-cli-acceptance.yml, and paired-benchmark workflow steps to capture OUTPUT_AUDIT_JSON / GATED_RUN_ID from run output, expose them as step outputs, and then use those outputs (audit_json, gated_audit_json) for validation, verification, archival, docs publication, artifact uploads, and commit staging instead of hard-coded proofs/latest-audit.json paths.
• Added robust runtime checks and failure modes when generate_certificate.py or sir benchmark run do not emit expected outputs, and included proofs/local-audit.* in artifacts to preserve non-canonical run certificates.
• In src/sir_firewall/core.py introduced MIXED_MODE_REASON, a new _reject_mixed_mode_validation helper, a dedicated _RULE_GROUPS entry for mixed-mode validation, and switched the mixed-mode code path to emit multiple_ingress_modes_not_allowed with the new mixed_mode_validation_failed reason, while improving rule group lookup in _build_block.
• Updated runtime behavior in red_team_suite.py to stop supplying pack_hash from the harness (pack hash remains a backlog item), and updated unit tests and expected outputs accordingly.
• Documentation: bumped README.md to SIR v2.2, added docs/backlog.md, added docs/evidence-perimeter.v4.md, and added docs/release-notes-2.2.md changes describing semantics and operator changes.

Testing

• Ran the unit test suite with pytest -q, including updated tests tests/test_tool_result_ingress.py and tests/test_pack_binding.py, and the test run completed successfully.
• Exercised CI workflow logic locally by running the relevant tools/generate_certificate.py and sir benchmark run simulation paths to verify step-output parsing and error handling, which produced expected outputs and exit codes.
• Verified that certificate contract validation and signature verification steps are invoked against the emitted audit_json when present, and are skipped cleanly when the run produced only a local non-canonical certificate.

---

Codex Task