Provision runtime-only Ubuntu and Fedora proof images and pin the proof roles to their observed identities. Install Debian and RPM packages into each disposable container's live root so declared dependencies are enforced, while retaining /proof-root isolation for tar proofs. Canonicalize the Ubuntu linker banner to its approved name and version so vendor parentheticals do not exceed the identity word cap.