Bind essentials recovery to explicit manifest and verified offsite provenance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

scripts/capture_forgejo_archive.py

@@ -61,8 +61,10 @@ def capture(namespace, pod, destination, profile="full"):
             actual = hashlib.file_digest(source,'sha256').hexdigest()
         if actual != expected: raise ValueError('archive transfer mismatch')
         validate_archive(destination, profile)
-        if profile == "essentials" and destination.stat().st_size > 600*1024**2:
-            raise ValueError("essentials archive exceeds budget")
+        if profile == "essentials":
+            from forgejo_essentials_profile import seal
+            seal(destination)
+            validate_archive(destination, profile)
     finally:
         # Do not remove a file while a timed-out producer may still be writing it.
         if completed:
@@ -76,8 +78,8 @@ def main():
     p.add_argument("--profile",choices=["full","essentials"],default="full")
     a=p.parse_args()
     try: capture(a.namespace,a.pod,a.output,a.profile)
-    except Exception:
-        print('ERROR: Forgejo archive capture or integrity validation failed')
+    except Exception as error:
+        print('ERROR: Forgejo archive capture or integrity validation failed ('+type(error).__name__+')')
         return 1
     print('Forgejo archive capture and integrity verified')
     return 0