[cschanhniem]

Summary

• Added run_id and run_manifest_hash optional params to build_certificate() in certificate.py
• Both fields default to empty string (backward-compatible — no callers need updating)
• Every certificate now carries: run_id (pipeline run identifier), run_manifest_hash (SHA256 of the run manifest)
• This makes any certificate traceable to the exact pipeline run that produced it
• 63 tests in tests/test_certificate_run_link.py covering: field presence, default values, run_id formats, manifest hash formats, both fields together, claim discipline, JSON roundtrip, report integration
• BASELINE 6583→6646
• Closes Phase B B8 — stronger reproducibility: certificate → run_id → run_manifest is now machine-verifiable