Harden responsive addon delivery gates

[nicodes]

Self-verification evidence (Team No Review)

Issue: https://github.com/aviorstudio/fieldsofrevik/issues/151 — initial truthful gate layer. No review requested.

• Source: aviorstudio/gd-responsive, issue-151-studio-engineering, exact head 4b046528c136d589ea9e89a19be045eb3d1f4319; baseline/control 73752cef4ca83ddd9691cf0f80e54a3e469a5b5d.
• Gate controls — PASS: missing script, parse failure, assertion mutation, runtime push_error followed by zero, unexpected error log, missing reach sentinel, and 1-second hang all failed; restored fixture reached one assertion and passed (GATE_CONTROLS_RESTORED_PASS count=7). Grid/flex always-true assertions were replaced with mutation-sensitive geometry/state checks.
• Engine/tool identity — PASS: Godot 4.7.2.stable.official.ed1daf0bf; Linux ZIP SHA-256 cadd3204e728a35d3f13adb7fd0d7902636b79f6b95c40c265eb73b6c35329e4; templates SHA-256 f298490b8d44d934be425a5a65a51bf15f422428b229a06a6e11d9ffea248011; actions pinned to full SHAs, including gdam-actions d735444eb470194585def44521d5d91df2260e63.
• Closed package/install/editor/web — PASS: exact-head CI built 26 declared files, ZIP SHA-256 d555f00617cfe6131b2dfc4a4cda11f0d2778a9df2a8311d80b8c5b3e8156d52, installed-tree digest 5debc7b18bf00f5df2a4b1679d8a5b597f0ea0938b5143a66f8135eba203bbbc; symlink/traversal/undeclared/missing entries fail closed. Packaged bytes enabled, restarted, disabled, restarted, removed their UID-serialized autoload, and preserved a consumer-owned autoload. Web export passed.
• Release security — PASS: PR permissions are contents-read; release-only job grants contents-write, runs the common suite, uses the already-tested dist ZIP without rebuilding, and isolates GDAM secret use to publication.
• Exact-head CI — PASS: https://github.com/aviorstudio/gd-responsive/actions/runs/34717288069
• Commands: GODOT_BIN=/tmp/opencode/godot-4.7.2/Godot_v4.7.2-stable_linux.x86_64 ./tests/test.sh; ./scripts/package_addon.sh; ./scripts/verify_package.sh; packaged install with 30-second editor command limits and 4.7.2 web templates.
• Narrow reproduced output allowance: only Godot 4.7.2 scripted headless-editor shutdown RID type lines (plus the exact three-resource line during disable) are allowed; every other ERROR remains fatal. This is not an engine-defect attribution.
• Untested in this layer: behavior-layer cross-field validation and final release/GDAM registry (handled by dependent PR Warn on invalid responsive resource ranges #11 and post-merge release). Browser screenshot is not applicable to this gate-only diff; runtime browser evidence is on PR Warn on invalid responsive resource ranges #11.

[nicodes]

Refreshed exact-head required check

After native stack linking exposed the earlier cancelled pull-request check as the branch-protection result, I reran that exact check without changing source. Exact head remains 4b046528c136d589ea9e89a19be045eb3d1f4319.

• Required ci: PASS — https://github.com/aviorstudio/gd-responsive/actions/runs/34717248998
• Seven deliberate failing controls and restored fixture: PASS (GATE_CONTROLS_RESTORED_PASS count=7)
• Suite: PASS, 5 scripts; flex 31, grid 28, layout 14, package 35, scale 10 assertions
• Package: PASS, 26 files, ZIP SHA-256 cfd7701896ed6908fe69324e35cd5257cd32875ac637915dbc25cc7c6ed1042b
• Installed tree: PASS, SHA-256 5debc7b18bf00f5df2a4b1679d8a5b597f0ea0938b5143a66f8135eba203bbbc
• Packaged web export: PASS

No code or evidence changed during replay.