ci: enforce bundle-required in Trust Verify (drop advisory adoption mode)

.github/workflows/trust-verify.yml

@@ -38,4 +38,3 @@ jobs:
       - uses: kontourai/flow-agents/.github/actions/trust-verify@e5f348b49f8130f9d452e73b104ba328f9916981 # flow-agents @ reports which DECLARED condition failed (#1015)
         with:
           verify-command: "npm run verify"
-          missing-bundle-policy: "advisory"

delivery/DECLARED

@@ -7,7 +7,7 @@
   },
   {
     "scope": "author:dependabot[bot] branch-prefix:dependabot/",
-    "reason": "Dependabot dependency-bump PR; no agent delivery involved, nothing to reconcile. Compound scope binds the platform-set actor identity to the bot's branch namespace per ADR 0022's fork-PR guidance, paired per the 2026-07-03 addendum. Provisioned AT adoption rather than rediscovered by breaking \u2014 flow-agents#1017's three worked examples are why.",
+    "reason": "Dependabot dependency-bump PR; no agent delivery involved, nothing to reconcile. Compound scope binds the platform-set actor identity to the bot's branch namespace per ADR 0022's fork-PR guidance, paired per the 2026-07-03 addendum. Provisioned AT adoption rather than rediscovered by breaking — flow-agents#1017's three worked examples are why.",
     "approved_by": "brian.anderson1222 (delegated approval, 2026-07-27 session: scoped-DECLARED-exemption route)",
     "declared_at": "2026-07-27T21:30:00Z"
   },
@@ -16,5 +16,11 @@
     "reason": "TypeScript 7 with the coupled tsconfig change the bot cannot author: tsgo no longer auto-includes @types/node, so the bump alone fails TS2591 on every node: builtin. Proven on the relay canary (relay#39); full verify green here under the new toolchain. Supersedes the bot's red dev-dependencies PR. Scope paired with author: per the ADR 0022 2026-07-03 addendum.",
     "approved_by": "brian.anderson1222 (delegated approval, 2026-07-28 session: scoped-DECLARED-exemption route)",
     "declared_at": "2026-07-28T03:00:00Z"
+  },
+  {
+    "scope": "author:briananderson1222 branch-prefix:chore/tv-enforce",
+    "reason": "Removes missing-bundle-policy: advisory from the Trust Verify workflow so it inherits the action default (required). Advisory was the adoption stance; with Trust Verify now a required status check in this repo's branch protection, advisory mode is a hole: a live gate probe on a sibling repo (a PR deliberately carrying no bundle and no exemption) passed Trust Verify green and sat MERGEABLE, and this repo runs the identical configuration. One workflow line, no source or behaviour change, nothing for a bundle to reconcile. Verification in lieu of a bundle: this PR's own CI runs the full verify matrix, and the sibling repo's probe re-run under required mode records the negative proof for the shared configuration. Scope is paired with author: per the ADR 0022 2026-07-03 addendum, since branch-prefix alone resolves against a pusher-controlled ref.",
+    "approved_by": "brian.anderson1222 (delegated approval, 2026-07-28 session: owner said fine-to-arm pending working-system evidence; this is the evidence loop)",
+    "declared_at": "2026-07-28T19:45:00Z"
   }
 ]