ScanRoo release validation repair

Implemented fail-closed release validation in an isolated ScanRoo handoff worktree and delivered the tested commit to the Claude integration lead under Rich's renewed approval.

• Host: rdmsm4x. Ticket: ISSUE-20260922-10.
• Base main: 82dcec4c875c38f58bb8b384506d860043012413; main was clean and matched freshly fetched origin/main.
• Commit: 193fb3d, branch codex/scanroo-release-validation-20260922.
• Worktree: /Users/richh/dev/_handoff/codex-out/scanroo-release-validation-20260922.
• Changed project files: scripts/submit_appstore.zsh; Tests/Release/test_submission.py; docs/release-evidence/2026-09-22-submission-validation.md.
• Changes: reject bypass, unsigned/wrong-team installer, Developer ID app signing, false sandbox entitlement, unreadable/empty package payload, and absent credentials. Recognize canonical ASC credential variable names without printing values.
• Commands: git fetch origin; git worktree add; python3 -m unittest discover -s Tests/Release -v; zsh -n scripts/submit_appstore.zsh; swift test --package-path Packages/ScanRooKit --parallel; git diff --check; gitleaks dir scripts --no-banner --redact; git commit.
• Verification: all eight release tests passed including a valid positive control; shell syntax and whitespace checks passed; full current Swift package suite exited 0 with existing unused-variable warnings; Gitleaks reported no leaks.
• Artifact evidence: pkgutil --check-signature build/ScanRoo-macOS.pkg returned Status: no signature, exit 1. Archive Info.plist IDs are app.scanroo.ScanRoo on iOS and com.eastcoastscience.ScanRoo on macOS. Current dist signature reports Identifier=ScanRoo, TeamIdentifier=not set.
• Canonical source, installed apps, bundle IDs, entitlements, user scans and cloud containers were not changed. No upload occurred.
• Coordination file: /Users/richh/.agent-coordination/checkins/codex-scanroo-release-validation-20260922.json.
• Ticket created and evidence appended; integration/release message sent to claude@rdmsm4x with bus ID 20260922-193527-CDA6529D. Delivery is recorded; acceptance and integration are not yet verified.
• Remaining work belongs to the release lead: integrate repair, reconcile existing recorded identity decisions against Apple records, produce signed matching artifacts, validate, upload. Rich's approval is included in the handoff.
• Recovery: parent commit and original canonical checkout remain unchanged. To undo this isolated repair, retain the branch and revert 193fb3d after checking for subsequent work. No destructive cleanup is required.