Materialize demo scenarios from immutable tags, not upstream branches

[RollNuts]

Summary

The two collision scenarios used to be long-lived collide-a / collide-b
branches on this shared upstream repository. Deleting those branches (to release
stale head reservations) broke the public sandbox: verify_fixtures.py,
check_docs.py, and CI all required the branches to exist.

This replaces "long-lived upstream branches" with immutable tags + a fork
materializer, so anyone can reproduce the walkthrough without a scenario
branch ever living on this shared repo again.

Scope

• demo-manifest.json — schemaVersion 2.0.0. Each scenario now carries
  sourceRef / sourceCommit / outputBranch instead of branch; adds
  fixtureMode: materialize and reproducibleFixture; splits the old
  recordedRun into historicalRecordedRun (Agent A: 5% bulk discount #1/Agent B: flat $10 large-cart discount #2, closed) and
  currentLiveProof (Agent A: 5% bulk discount over $100 #13/Agent B: flat $10 large-cart discount #14, open). Public contract stays 1.0.0.
• scripts/materialize_fixtures.py — new. Verifies each source
  commit/base/diff/tests, then creates the scenario branches in the user's own
  fork. Idempotent, never force-pushes, refuses to target this upstream repo,
  fails closed on a dirty tree, and prints no tokens or credential URLs. Sends
  nothing to Veripsa.
• scripts/verify_fixtures.py — verifies the immutable fixture-v1-* tags and
  their exact commits, not deleted branches.
• scripts/check_docs.py, README.md, orders/pricing.py — updated to the new
  contract and the fork-materialize walkthrough.

Validation

Local (Python 3.9): pytest (5 passed), check_docs.py (parity ok),
verify_fixtures.py (both tags verified against base/diff/tests). Clean-room
end-to-end against a main-only fork: dry-run plan → --push created both
branches at the exact source SHAs → idempotent re-run was a no-op → an induced
divergence made the materializer stop without force-pushing. Guard tests:
refuses upstream by slug and by URL even with a dirty tree; strips credentials
from URLs.

Deployment

Docs/fixtures only — no runtime component. The immutable source is the annotated
tags fixture-v1-agent-a (f21bd2b) and fixture-v1-agent-b (d589350),
already pushed. CI (.github/workflows/fixtures.yml) fetches the tags and
asserts the materializer refuses the upstream repository.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[veripsa-core]

Veripsa — heading to main

❓ Unknown — not enough signal to call this clear

This PR reserves: demo-manifest.json, .github/workflows/fixtures.yml, scripts/check_docs.py, scripts/materialize_fixtures.py, scripts/verify_fixtures.py

New paths in this PR — coupling will be computable after merge. These paths are NEW in this PR, so there is no main-side graph to compare against yet (expected, not a warning): scripts/materialize_fixtures.py. Veripsa will compute their coupling once this PR lands.

Some other paths aren't in Veripsa's graph yet (unverified, not 'safe'). These paths are in main but NOT in Veripsa's graph — an unsupported language, an un-indexed area, or an extractor gap — so Veripsa can't compute their coupling: demo-manifest.json, .github/workflows/fixtures.yml. Treat as unknown, not clear.

_{Veripsa records what is heading to main and who reserved what — it does not assert correctness. Advisory by default; your branch-protection policy decides what blocks.}