P1: Cut the attested fixture bundle tag for downstreams (regeneration shipped in #60)

[macanderson]

The golden fixtures predate the normative sweep (#33) and representations (#41):

• No golden vectors exist for representation / content_ref / fidelity, and context-frame.valid.json fails the §B3 honesty rule it predates.
• Downstreams are papering over the gap: oxagen's packages/run-evidence pins fixture copies at 36a6448 (pre-Pre-freeze normative sweep: SPEC.md, canonical token accounting, conformance that actually catches things #33) behind a sha256 manifest + drift gate, and the ADR-036 SDK adoption had to author unattested local vectors because the upstream goldens don't cover the current surface. Stella pins 9fb559a via three hand-duplicated git-rev pins with a version-string tripwire test.

Two consumers on two different stale commits, each independently re-deriving what the goldens should say, is exactly the failure mode #29/#30 exist to prevent — already realized.

Acceptance

• Goldens regenerated against the current wire surface (after P0: SPEC.md completeness: fold verify, representations, frame identity, and consent scopes into the normative home (restore context-reuse §3) #49 lands, so vectors cite spec sections that exist), including representation, B3 canonical-cost, and F4 temporal vectors. — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60: fixture profile bumped to 1.1.0, 7 fixture files, 23 frame fields, and a per-file sha256 manifest gated by a strict-coverage test.
• Published as a named, attested bundle (a tag per P0: Cut the v0.0.2 tag that MIGRATION.md already tells downstreams to pin #30 is enough) that downstream drift gates can point at instead of raw revs.

Feeds #29 (canary CI) and GOVERNANCE freeze criterion 4.

---

Remaining scope (2026-07-26): only the publication half survives. The manifest already gives downstreams their digest surface; what is missing is an addressable one — git tag -l still returns only the pre-rename ocp-v0.1.0.

Blocked on #30, not #49. The #49 dependency in the acceptance criterion above is discharged (the regeneration in #60 cites spec sections that exist). The tag this issue needs to reference is the one #30 was filed to cut.

[macanderson]

Re-verified 2026-07-26 against origin/main @ 1ee9b1c.

What landed (PR #60, which names this issue): the regeneration half, in full. Profile bumped to 1.1.0, seven fixture files, 23 frame fields, and a per-file sha256 manifest gated by a strict-coverage test — so the fixtures cannot silently drift out of the manifest.

What survives: the publication half only. git tag -l returns just the pre-rename ocp-v0.1.0, so there is no addressable point for a downstream to pin the attested bundle at.

Recommended scope: narrow to the publication half, and re-block on #30 rather than #49 — the manifest already gives downstreams the digest surface they need; the only missing piece is a tag to fetch it at, which is #30's one command.