Add one atomic candidate transaction with missing-proof-only resume and read-only offline recovery. Route make release through it and confine the direct build helper to non-candidate drift output so neither can bypass or replace dist/rust. Build both package lanes from one immutable committed context, enforce digest-only committed image policy, and bind the ordered offline cargo-deny cohort to an isolated advisory database. Retain the versioned out-of-payload ledger and Debian, RPM, and tar package proofs as the gate for local candidate-proven status. Remove the render --evidence fabrication path. Nothing tags, signs, uploads, or publishes. No real container build, advisory network access, or package installation ran while implementing or validating this change.