fix: close immutable promotion trust gaps

scripts/lib/release-candidate.ts

@@ -34,6 +34,7 @@ export const RELEASE_CANDIDATE_MANIFEST_PATH =
   "artifacts/release/release-candidate.json";
 
 export const RELEASE_CANDIDATE_EVIDENCE_PATHS = Object.freeze([
+  "pnpm-lock.yaml",
   "artifacts/performance/bundle.json",
   "artifacts/quality/vite-module-inventory.json",
   "artifacts/release/build-manifest.json",
@@ -113,10 +114,21 @@ export async function createReleaseCandidateManifest(
       "utf8",
     ),
   ) as { lockfileSha256?: unknown };
+  const rawLockfileSha256 = evidence.find(
+    (file) => file.path === "pnpm-lock.yaml",
+  )?.sha256;
+  if (
+    typeof rawLockfileSha256 !== "string" ||
+    dependencyInventory.lockfileSha256 !== rawLockfileSha256
+  ) {
+    throw new Error(
+      "raw pnpm-lock digest mismatch with dependency inventory",
+    );
+  }
   return releaseCandidateManifestSchema.parse({
     schemaVersion: 1,
     distSha256: distSha256(outputs),
-    lockfileSha256: dependencyInventory.lockfileSha256,
+    lockfileSha256: rawLockfileSha256,
     bundleSha256: supplyChainDigest(files),
     files,
   });