ci(python-gonol): provision pinned UCNS authority

[erinepshovel-code]

Exact main 198c9da486b6f7194f927f839c7040e8655973f9 introduced the Python Gonol construct and left the python-gonol / contracts gate red: all five tests failed before exercising construction because they require a Git checkout of the exact UCNS Public Gonol authority and CI supplied none.

This repair changes only the owning CI boundary:

• preserve the implementation's exact source-backed pin ucns@62e08ee1cf3b5d7b6e48c927b1047509e6328b5c;
• run stack structural consistency before materializing the external checkout;
• checkout that exact UCNS commit under .ci/ucns with persisted credentials disabled;
• pass the checkout explicitly through UCNS_SOURCE_ROOT to the existing tests.

No Python Gonol or UCNS semantics change, no authority transfer, no fallback checkout, and no weakening of exact Git/module/digest verification.

hmmm: this proves the CI host can supply the declared producer identity; it does not promote the Python Gonol candidate or resolve its deeper geometry.

[erinepshovel-code]

@codex review

Review exact head da53c1181d5b7cb8ea2e41f6791973411e6b8ae9 for substantive P1/P2 defects in the CI repair only: exact UCNS identity, checkout placement, authority/non-transfer boundary, workflow safety, and whether the five Python Gonol tests now execute their real contract rather than bypassing producer verification.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T12:43:48.016501Z	da53c11	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: da53c1181d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".