Implement bounded release runtime and durable native health sampler

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/evidence/2026-10-11-release-runtime/caller-bindings-observation.json

@@ -0,0 +1,10 @@
+{
+  "schema_version": "activity-core-release-caller-metadata/v1",
+  "serviceaccounts": [
+    "activity-core-eso",
+    "default"
+  ],
+  "bindings": [],
+  "secret_read": false,
+  "native_mutation": false
+}

docs/evidence/2026-10-11-release-runtime/principal-observation.json

@@ -0,0 +1,7 @@
+{
+  "schema_version": "activity-core-release-principal-observation/v1",
+  "estate_cluster_uid_verified": true,
+  "dedicated_serviceaccount_present": false,
+  "secret_read": false,
+  "native_mutation": false
+}

docs/evidence/2026-10-11-release-runtime/validation.json

@@ -0,0 +1,36 @@
+{
+  "schema_version": "activity-core-release-runtime-preparation/v1",
+  "task": "ACTIVITY-WP-0041-T03",
+  "prepared_at": "2026-10-11T21:19:23.517339+00:00",
+  "scope": "ACTIVITY-WP-0041-image-only-v1",
+  "tests": {
+    "command": "PYTHONPATH=src python -m pytest tests/test_gitops_release.py tests/test_release_broker.py tests/test_release_transport.py tests/test_release_dispatch.py tests/test_release_health.py tests/test_release_sampler.py tests/test_release_runtime.py -q",
+    "passed": 113
+  },
+  "native_acceptance": false,
+  "native_mutation": false,
+  "secret_read": false,
+  "fixture_keys_are_authority": false,
+  "source_bootstrap_starts_soak": false,
+  "native_required": [
+    "dedicated authenticated principal",
+    "exclusive Git/Kubernetes credential custody",
+    "independent signed issuer/owner acceptance",
+    "deployed continuous observer",
+    "Temporal registration",
+    "normal release and failed health rollback",
+    "revocation and denials"
+  ],
+  "coordination": {
+    "case_id": "ACT41-release-custody-2026-10-11",
+    "scenario_type": "cross_owner_wait",
+    "state": "waiting",
+    "beneficiary_workplan_id": "ACTIVITY-WP-0041",
+    "beneficiary_task_id": "ACTIVITY-WP-0041-T03",
+    "obligor_repo": "railiance-platform",
+    "obligor_intake_id": "RPF-IN-0011",
+    "blocked_on": "message-from:railiance-platform",
+    "reason": "independent owner preparation; awaiting exact owner task binding; no circular RPF48 dependency",
+    "central_projection": "not yet published"
+  }
+}