Harden readable prompt and provenance contract edges after #476

Review PR #575 and its referenced review discussions first; then inspect the readable-goal-prompt and autonomous-merge contract tests, workflows/pr-batch-intake.md, and the FORBIDDEN_PROMPT_FRAGMENTS guard. Choose a focused hardening scope, preserve the listed prompt, provenance, byte, and fail-closed invariants, and add focused tests for the accepted changes.

Context

PR #575 implements issue #476's readable run-prompt and launcher-provenance contract. At exact head a3945fc111e09b243a8f4b3dec5112b0cef2d016, the final Claude review reported five non-blocking hardening observations. None is a verified correctness or security defect in the shipped contract, so they are deferred from the throughput closeout rather than starting another remediation loop.

Follow-up scope

• Revisit whether the readable prompt should continue to expose only human auto|ask while machine-only merge_authority: none remains exclusively in the accompanying Batch Plan. Preserve the current non-standalone-prompt invariant unless a new design explicitly replaces it.

• Replace or precisely define an equivalent existing content binding in the trusted-ad-hoc reverification prose. Any revision must preserve the existing same immutable accepted provenance/authority record requirement and fail closed for missing, mutable, changed, or UNKNOWN bindings.

• Make the optional future workflows/pr-batch-intake.md routing split explicit rather than triggering solely from incidental file existence.

• Decide whether the readable-goal-prompt contract test should declare itself source-checkout-only or skip cleanly when source-pack docs are absent.

• Strengthen the autonomous-merge contract test to assert exactly one canonical GMCC-v4: workflow line, even though the sibling byte-alignment test already covers the current contract.

• Decide whether to replace the intentionally broad FORBIDDEN_PROMPT_FRAGMENTS substring guard with structured field-name matching, or document that its broad common-word matches are deliberate regression protection for the fixed prompt template.

• Add an end-to-end selection → launch → worker digest-mismatch harness, or define an equivalent executable evidence seam, so the workflow-policy stop behavior can be verified beyond source-text drift tests. Preserve the current executable preflight snapshot and fail-closed agent contract in the meantime.

Acceptance criteria

• Handle these as one focused hardening change after PR #575; do not reopen #476's prompt simplification design by default.
• Keep human-authored prompt fields free of launcher metadata and machine-only policy.
• Preserve exact canonical-source byte handling, prompt-source digests, append-only run records, and fail-closed trusted-ad-hoc provenance checks.
• Add or update focused tests for any accepted hardening change.

Review sources: #575 discussions r3891461426, r3891474469, r3891474794, r3891475075, r3891475192, r3901090454, and r3901090956.