fix: close immutable promotion trust gaps

scripts/verify-archived-local-evidence.ts

@@ -0,0 +1,19 @@
+import { readFile } from "node:fs/promises";
+
+import { verifyArchivedLocalEvidence } from "./lib/local-release-evidence.ts";
+import {
+  RELEASE_CANDIDATE_MANIFEST_PATH,
+  releaseCandidateManifestSchema,
+} from "./lib/release-candidate.ts";
+
+const candidate = releaseCandidateManifestSchema.parse(
+  JSON.parse(await readFile(RELEASE_CANDIDATE_MANIFEST_PATH, "utf8")),
+);
+const result = await verifyArchivedLocalEvidence({ candidate });
+if (result.status !== "PASS") {
+  process.stderr.write(
+    `Archived local evidence verification failed:\n- ${result.failures.join("\n- ")}\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write("Archived local evidence verification: PASS\n");