fix(ci): initialize required PCS workspace checkout and contributor toolchains

[fraware]

Draft — strict corpus validation still red

The branch restores workspace/tool setup and preserves the exact bytes of the two computation-release fixtures. On current head 76abb8fb5a0208123b1508dacf5e035d87eb6a0c, portal-ci, lean-ci, mcp-contract, docs-blueprint, and security-sarif pass. Corpus-validation fails with 17 failed, 353 passed, 11 errors, 5 skipped.

Byte-integrity work completed

• The 11 entries in computation-release/release_manifest.v0.json hash-match the original CRLF bytes, not the LF-normalized form.
• The same 11 entries in computation-rejected-release/release_manifest.v0.json independently hash-match the original CRLF bytes.
• Restored CRLF on both fixture sets without changing JSON values or expected manifest digests, and added targeted .gitattributes entries. The latest run no longer reports manifest digest mismatches.

Unresolved release-evidence blocker

PCS Core 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b requires the release-blocking ResultArtifact.v0.payload_bytes_match_digest check to be executed and cited in the release chain; release-chain enforcement cannot be deferred. The committed computation-release/result_artifact.json declares outputs/summary.parquet, size 4096, and a placeholder-looking sha256:eeee... digest, while that payload is absent from the checked-in fixture. The release chain claims ProofChecked without a check citation. These claims cannot be repaired by adding a synthetic 'passed' record or weakening PCS validation. Resolve with authoritative payload bytes, a verified digest/size, and correctly regenerated, traceable signed release evidence.

Other errors in rendering, benchmark ingest, and release-grade coverage cascade from failed imports; triage independently after the upstream evidence blocker is resolved.

Merge gate

Remain Draft. Do not merge with corpus-validation failing. Do not rewrite evidence claims, thresholds, or signatures to manufacture a passing test.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.