Replace the publish CLI check-minisign shim with a standalone install-check script that follows the scripts/check_*.py convention. The gate generates a throwaway keypair, signs the committed transparency entry fixture, verifies it, tampers one byte and requires verification failure. Missing minisign is a loud failure with the install command, never a skip.