[leehack]

Vulkan artifact validation now rejects the reproduced triangle-shader zero-to-NaN compilation defect before packaging or publication. The guard checks the embedded shader bytes; prepared releases without auxiliary capture metadata must pass the same byte-level proof. Archive validation also rejects paths and links that could overwrite a checked library during extraction.

No upstream source patch is included. The shader-compiler report remains local. Existing prepared artifacts retain their original source identity.

Validation at d0c6af0849ea57f727ff60270d06ff1c334fc108 (tree f66db0c405f30b76da89ef28f9ee6ddf075d85ff):

• Full Python suite: 102 tests passed, 16 skipped; focused guard and release-contract checks passed.
• Nine causal controls failed with their intended mutations and passed after restoration.
• Independent adversarial review accepted the exact tree, including a reproduced archive-alias overwrite attack and eight additional alias cases.
• Local replay of prepared run 41554383363 passed across 27 files, 25 archives and all three Vulkan payloads without changing its source provenance.

Independent review receipt SHA-256: c3409ac2603220da7a36d6ed077d2c55a556d3ac683239d356c015c97901dd1f.

Current-head CI and hosted prepared-artifact replay remain required before publication. This PR does not establish a defect in published v0.3.0-1 or resolve the separate model-loading investigation.