Release standard: promote manual witness run to a CI gate, add scry

[avrabe]

Sweep finding: relay is the rivet-extraction gold standard (174 verification artifacts all linked, 120/128 SWREQ, test/target-level verifies) — but its witness MC/DC on the real fused cascade is a manual run, asserted via a sync-sibling coverage target rather than the shipped component, because the bundled witness can't parse component-format exports (witness #145). And scry is absent.

Track C — wasm gates (priority):

• Promote the manual witness run to a CI/release gate on the shipped falcon-flight-*.wasm (tracks witness witness MC/DC on the real flight component (falcon_flight_component.wasm) #145 — the component-export parse blocker).
• Add a scry abstract-interpretation gate.
• sigil-sign the component (currently cosign-over-sums) — blocked on friction: wsc can't sign its own wasm32-wasip2 output — blocks org-wide sigil-sign-wasm standard sigil#164.

Track A done (full + double-signed bundle); Track E gold (no action). Track B (distribution) N/A — relay is an application, not a published tool.

---

Part of the org-wide release-consistency campaign — the five-track standard is in the release-artifact-pipeline skill (plugin v0.10.0).
Coordination hub: pulseengine/pulseengine.eu#98 — if this standard does not fit this repo (you need a deviation, different sequencing, or want to sync on how a track applies), raise it there. Deviations are decided in the open at the hub, not diverged silently.