fix(release): accept verified Sigstore versions

[davesheffer]

Summary

• fix the executable Sigstore semantic-version guard after successful bundle verification
• add a contract test that executes the extracted guard against a real version
• bump the npm package and active docs/static site to v1.9.3

Evidence

• public @davesheffer/hunch@1.9.2 integrity exactly matches the immutable v1.9.2 candidate
• public v1.9.2 includes SLSA provenance; its attempt-3 failure was only the double-escaped verifier-version regex
• focused release contracts pass
• typecheck and build pass
• Hunch conformance 4/4; merge verdict PASS

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hunch	Ready	Preview, Comment	Jul 23, 2026 1:21pm

[github-actions]

🧠 Hunch — Engineering Memory Guard

✅ This PR touches no recorded invariants (directly or via blast radius) and re-introduces nothing deliberately retired across 16 changed file(s).

📜 Hunch Constitution — 2 policy receipt(s)

• ✅ pol_01cf084e1e satisfied — symbol:renderAdoptedDoc does not reach symbol:writeFileAtomic
  • receipt: sha1:a05dce4e93231bf64ee9b956cd6ed9ae7983cb40
• ✅ pol_3f3aee11ad satisfied — symbol:src/store/db.ts:openDb does not reach external:better-sqlite3
  • receipt: sha1:dca16fa39ca2ddcfb3d0e699097c45bd4e692239