/claim #1331

What changed

Adds fixture-backed registry availability and rollback continuity gates to model-supply-chain.

• Adds MODEL-RET-01 through MODEL-RET-08 for immutable internal mirrors, retention/deletion controls, complete artifact sets, adapter/base/tokenizer/config binding, license/access snapshots, immutable rollback copies, clean-environment rebuild drills, and upstream deletion/gating ownership.
• Adds a Registry Continuity Evidence output table covering upstream source, mirrored artifact set, digest binding, retention control, release-time terms, rollback target, drill evidence, and assessment.
• Updates the model inventory, finding category list, maturity summary, and common pitfalls so pinned revisions are not over-scored as availability guarantees.
• Adds benign/vulnerable YAML fixtures for a mirrored rollback-tested release versus a yanked/gated public-registry dependency with no internal mirror.

Why this PR

Existing PR #1353 is a useful SKILL.md-only implementation. This PR is intentionally fixture-backed and adds concrete skill-local examples so future reviews can distinguish integrity pinning from operational continuity when public registries remove, gate, rename, or evict model artifacts.

Validation

• git diff --check origin/main...HEAD
• git merge-tree --write-tree origin/main HEAD
• Markdown fence balance for model-supply-chain/SKILL.md
• YAML parse check for both added fixtures
• Marker checks for version: "1.0.1", Registry Availability and Rollback Continuity, Continuity evidence gates, MODEL-RET-01 through MODEL-RET-08, Registry Continuity Evidence output, Internal Mirror, Rollback Copy, and Treating revision pins as availability guarantees
• Fixture marker checks for mirrored and vulnerable public-registry continuity cases
• Added-line ASCII scan
• Added-line sensitive/public-contact pattern scan
• Remote fork branch tree verified to match local HEAD^{tree} after Git HTTPS push failed and the branch was created through the GitHub Git Data API

Bounty tier

Requesting Improver Moderate ($100) if accepted. This adds local benign/vulnerable fixtures in addition to the registry-retention and rollback-continuity guidance requested by the issue.