chore(retirement): port E03 packet tooling to Rust before PowerShell retirement

[Fancy0uth]

Parent: #341. Bounded E03 retirement-packet tooling cutover: port the remaining E03 PowerShell generate/verify/rehearsal path to Rust under the existing native CLI. Preserve packet schema, all three blockers, fail-closed status, live-probe evidence, rollback and digest semantics. Static-unreachable proof applies only to E02/E03 per DR-0006; do not generalize to E04/E07/E08. Keep historical rollback fixtures and live CI/release checks until the Rust path has equivalent contract and packaging proof.

Acceptance: focused Rust packet tests and equivalent E03 generate/verify/rehearsal contract on an installed binary; no weakening of blocked evidence, proof or historical fixtures. Coordinate with #323. Branch main; approach is Rust-first E03 tooling with old entrypoints retained until external compatibility and packaging pass. Fancy0uth cannot apply claimed (REST 403); maintainer please add claimed before source edits.

[Fancy0uth]

Branch: main. Approach: implement the E03 generate/verify/rehearsal packet path in native Rust CLI, preserve blocked-state and live-probe evidence, then prove packaged behavior before retiring the PowerShell entrypoint. @maintainers please add claimed; my account cannot mutate labels (REST 403).

[Fancy0uth]

Local-only implementation evidence: native compatibility provider-preflight-packet generate/verify/rehearse route, exact blocked E00 three reasons/12 evidence and E01 denial, frozen source/diff, tamper exit65 and rollback rehearsal. GNU Rust 1.95 focused 3/3 and copied-binary CLI smoke passed. Legacy historical scripts retained; official installed MSVC/release topology unproved. Shared-tree Sentrux gate no degradation (quality 6236→6242, coupling 63.33→63.26); no commit/push. Maintainer claimed label still required before delivery.

[Fancy0uth]

Local E03 verification update: paired retained PowerShell/native generation on the same Windows checkout and clock yielded the same three blockers, twelve evidence IDs, and historical patch/base/necessity hashes; fresh packets verify under the native CLI (historical mode performs an independent current rollback rehearsal), while the old verifier is not expected to accept native packets. Focused Rust provider_preflight_packet suite: 5 passed including ignored round trip; native verifier rejects tampered evidence. The committed historical packet fails strict nested artifact SHA verification: decision ref 8b05ce9a... vs tracked replacement-atom file 513f1487..., tracked in #402. Keep the CI historical verifier and rollback fixtures until a reviewed corrected attestation exists; no deletion authority granted.

[2233admin]

claimed 已补上（维护者代劳，DR-0004）

Verdict: do. 本会话不接手实现，只做队列账面收敛。

Fancy0uth 2026-09-24 留言说明：账号只有 pull 权限，REST 打标签返回 403，请维护者代加 claimed。该请求在你 2026-09-24 15:22 的本地实现证据之后发出，当时你已报告"native compatibility provider-preflight-packet generate/verify/rehearse route"落地、GNU Rust 1.95 聚焦测试 3/3 通过、以及 16:44 的 PowerShell/native 配对生成比对（同样三个 blocker、12 条 evidence id、历史 patch/base/necessity 哈希一致）。

标签现在补齐，claimed 指向你评论中已载明的分支与一行方案，符合 DR-0004。这些都是本地证据，仓库里没有对应 PR（gh pr list --author Fancy0uth 为空），所以：

• 打标签只是把既有认领显式化，不构成对未提交实现的验收；
• 本票父票 chore(retirement): port E03 packet tooling to Rust before PowerShell retirement #400 的 E03 范围与子票 fix(retirement): reconcile invalid nested SHA in committed E03 decision #402（E03 嵌套 SHA 不一致）是同一片 E03 包区域，实现面请与 fix(retirement): reconcile invalid nested SHA in committed E03 decision #402 协调，避免并行改同一批 packet 文件。

注意 #402 恰好是已提交 packet 的自相矛盾：compatibility-retirement-decision.json 里的 replacement.atomEvidence.sha256 与 evidence/replacement-atom.json 实际哈希不符（PowerShell 校验器漏掉了这个嵌套 ref）。任何 strict native verifier 都会拒这份已跟踪 packet，所以历史 packet 切换在修掉它之前不能算已证明。修 #402 之前，#400 的验收标准"保留 blocked 状态与 live-probe 证据"会被这条不一致直接卡住——建议 #400 把 #402 作为前置。