rainix-static: assert every published Soldeer version still has its frozen src/generated record

[thedavidmeister]

Every check rainix runs today looks at ONE version — the one being released.
release-guard verifies the tagged commit's version, snapshot presence, monotonicity and
byte-exact regeneration, and frozen-snapshots-append-only catches a PR that edits or
deletes a frozen record. Nothing asserts the converse: that every version already
published to Soldeer still has its frozen src/generated/<tag>/ record in the tree.

The gap is demonstrated, not theoretical

• rain.factory.deploy commit 39d1cfd (2026-08-20) deleted three frozen snapshots while
  every CI check reported success. The append-only gate skipped because its predicate read
  the HEAD tree — fixed since (fix(tag-release): determinism check that never removes the frozen record #343), but that fix still only catches the deletion in the
  PR that deletes. A record that went missing before the gate existed, or through any
  path the diff-based gate does not see, stays missing silently.
• rain.math.float.deploy grew ~200 lines of bespoke bash
  (script/check-published-deploy-constants.sh) plus fixtures plus an FFI test reaching
  for exactly this property over its hand-written constants. That scheme is being migrated
  away (rain.math.float.deploy#8), and the check should not die with it — it should be
  generic.

The check

A rainix-static subcommand, shaped like the existing ones:

1. Read the published versions for soldeer-package from
   https://api.soldeer.xyz/api/v1/revision?project_name=<pkg> — the same endpoint
   soldeer_gate already queries.
2. For each published version X.Y.Z, assert src/generated/X_Y_Z/ exists and is
   non-empty in the working tree.
3. Fail listing every published version with no record. A repo with zero published
   versions passes vacuously.

Registry-versus-tree, no per-repo bash, no constant-name conventions.

Failure-mode lessons already paid for, carry them in

rain.math.float.deploy#3 spent a full hardening round on its bash version of this check,
and the defect class transfers directly: its SKIP branch keyed on empty output, which
conflated "network unreachable" with "response arrived but unparseable" — so a registry
schema change would have silently retired the check forever while every run stayed green.
The subcommand must fail closed on a response it cannot read, and distinguish that from
transport failure. soldeer_gate's existing registry handling is the in-repo precedent.

Where it runs

Two candidate call sites, not mutually exclusive:

• rainix-sol-static — every PR on every deploy repo catches a missing record when it
  happens, at the cost of a registry HTTP call per CI run and a network dependency in a
  currently-hermetic job.
• release-guard — only at publish time, hermetic PRs preserved, but a gap sits
  undetected between releases.

No recommendation baked in; whoever picks this up should weigh the network-dependency
cost against detection latency and say which they chose and why.