fix: recover first-use tracker and record verified closeout

[austinkennethtucker]

A rejected first status update previously rolled back tracker schema creation but left the SQLite file behind. Retrying after correcting the posting then failed because file existence suppressed initialization. The new schema now commits separately before the atomic status/history transaction, leaving a valid empty tracker after rejection. Existing empty or unsupported databases still fail closed without replacement.

This closeout also records the repository controls now applied and verified: main requires a current PR, resolved review threads and both native/repository checks bound to GitHub Actions; full-SHA enforcement is active; the repository action allowlist includes Claude and its exact nested Bun dependency. Claude execution retains a human environment gate with administrator bypass disabled. The release gate, read-only workflow defaults, fork approvals, secret controls and frozen vendor boundary remain intact. SETUP and TOOLING now distinguish tested source evidence from GUI, integration and signed-distribution acceptance; Sonar is deferred to owner onboarding.

Validation:

• The first-use/retry regression failed against unchanged pre-fix production code. After the fix, 48 core tests passed; normal unfiltered coverage discovery ran 178 tests with 3 explicit optional integration skips and zero failures.
• Independent source and documentation/settings reviews found no actionable findings. The recomputed diff is reviewed after predecessor merges; hosted checks must pass on this final head before merge.
• Synthetic CLI smoke passed initialization, import, package preview/create, duplicate refusal without mutation and redacted diagnostics. The task-built app displayed the disposable workspace, performed Submitted-to-Interview status updates, retained the result after refresh, and rendered posting/resume previews. SQLite contained exactly the expected row and two events.
• Installed Pandoc/Chrome/Poppler produced HTML, DOCX, PDF and text extracts from the synthetic resume; expected content was verified. This is bounded integration evidence, not full rendering or release acceptance.
• Python discovery passed 55 tests with 4 CLI opt-in skips; the separate CLI smoke passed. All 11 vendor manifest files, 23 synthetic vendor tests, shell syntax and committed-range whitespace checks passed.

Only synthetic fixtures and temporary workspaces were used. No signing, notarization, distribution, Apple submission, new service credentials or organization-wide access is included. Final merged-main checks and smoke are performed as the final closeout step.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T13:14:50.106443Z	8e24ea5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.