Bind delivered binaries to verified build source

docs/roadmap/remediation.md

@@ -1,7 +1,6 @@
 # ReleaseKit implementation review and remediation
 
-Status: Open. These findings describe work to address; this review changes no
-implementation or supported contract.
+Status: In progress. Resolution notes record completed fixes and verification.
 
 Date: 2026-10-06
 
@@ -57,6 +56,8 @@ ownership or runtime dependency weight.
 
 ### R1 — High: Delivery accepts binaries built from uncommitted source
 
+Status: Resolved.
+
 Category: Correctness and divergence from tagged-source delivery.
 
 **Evidence:** [The builder](../../internal/build/build.go) records `HEAD` in
@@ -86,6 +87,13 @@ become eligible for tagged delivery merely by cleaning the worktree afterward.
 Cover source changes during a build and unchanged clean tagged builds through
 the supported API and CLI receipt path.
 
+**Resolution:** Build results and private receipts now carry `SourceVerified`,
+set only after completed builds observe clean source and unchanged HEAD. Local
+dirty builds remain supported; binary delivery rejects their results and
+receipts even after checkout cleanup. API tests cover clean, initially dirty,
+and changed-during-build source; a CLI regression covers receipt delivery after
+cleanup. The offline suite and public boundary checks pass.
+
 ### R2 — High: Some successful page writes are reported as not attempted
 
 Category: Failure handling and recovery-state correctness.