feat(deploy): gate claims on pinned runtime readiness

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9

deploy/scripts/install-pinned-runtime.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Reproduce the host worker from uv.lock plus exact, clean sibling revisions.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "${REPO_ROOT}"
+
+command -v uv >/dev/null 2>&1 || {
+  echo "install-pinned-runtime: uv is required" >&2
+  exit 2
+}
+
+python3 scripts/verify_runtime_lock.py
+uv sync --frozen --no-editable --extra glas --extra llm
+.venv/bin/python -c 'import glas_harness, llm_connect, rein_aharness, sandboxer'
+.venv/bin/rein-aharness preflight --offline
+
+echo "Pinned non-editable runtime installed from uv.lock and runtime-contract-lock.json"