chore(release): probe protected Gemini candidate task

[drewstone]

The 0.3.4 protected live gate cannot complete a cloud turn with its configured glm-5.3 route. This temporary diagnostic installs the exact signed candidate archive, checks that the existing protected credential can list gemini-2.5-flash-lite, and runs one Braid headless task with a 64-token completion ceiling. It reports the terminal run, served model, candidate hash, and observed cost without changing the release gate. The workflow will be removed after its one-shot receipt.

Validation: local pnpm check in progress; node --check and pre-commit/pre-push hooks passed. Candidate and authenticated task remain pending.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[tangletools]

✅ Auto-approved PR — 21762e2e

Blanket team auto-approval is intentional. The merge gates are CI and codex-p1.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-09-29T10:44:10Z}