Prepare verifiable public source alpha

[AlbertXXuu]

Problem and behavior

The previous verifier required hand-authored configuration and its portable Demo checks could accept refreshed-hash contradictions between reports and success summaries. This change adds an explicit init → human-reviewed Playwright candidate → check → run → verify workflow, binds served build bytes, and independently checks report, exit, timing, status and cleanup consistency.

The source remains an experimental alpha at SPIKE_CONDITIONAL. It does not automatically generate finished tests, sandbox arbitrary candidates, prove authenticated execution provenance, or establish saved effort. The English AlvenX reference Demo, clone-first documentation, security disclosures and contributor entry now match that scope. Historical evidence is preserved.

Source: 24a67ec12464b3a38828bcf89e9405cb811c3e8f. Product Gate: separate commit 328cf137c1198bd774a040d4b486704fececa478.

Validation

• corepack pnpm check: 110/110 Node tests and 6/6 Chromium tests; typechecks, brand and all recorded-evidence gates passed.
• Independent detached checkout of the source commit: frozen install, the same complete checks, quickstart and package smoke passed.
• corepack pnpm quickstart: recorded DrawDB #687 evidence derives 20 functional failures before and 20 passes after the fix.
• corepack pnpm package:smoke: passed. corepack pnpm audit --json: zero known advisories across 36 dependencies.
• AlvenX parent brand/workspace validators passed; real browser checks covered 390/900/1440 px, resources, focus, reduced motion and header geometry.
• Two independent reviews reported no remaining P0–P2 blocker in the documented source-alpha scope.

Full commands, evidence and limitations: phase record and security review.

Review checklist

• The change stays within local functional QA scope and uses only explicit trusted commands.
• Candidate, target, evidence, path, timeout, cancellation and cleanup boundaries remain honest.
• Portable artifacts contain no credentials, private data, raw logs, or machine-specific paths.
• Product-stage and reliability claims do not exceed the executed evidence.
• Relevant focused checks and corepack pnpm check pass.

Repository visibility remains private pending the owner's separate decision about historical metadata disclosure. This PR does not publish a package or grant product GO.