[gabehamilton]

Scheduled sandbox verification failed because its host TLS lockfile policy treated upstream catching up to an approved patch as an error. PR #26 supplies the rustls bump; this PR builds on it, makes catch-up pass, and keeps unexpected dependency versions, sources, and checksums as failures.

The verification entry points are also separated:

• near-approval-watch owns polling. It compares only the approval core/contract crates and their workspace build inputs, then calls reusable near-approval at the changed upstream SHA. Unrelated trust-framework projects, sandbox tests, and documentation do not trigger verification. Pending successful-check PRs are compared by contract code, so later unrelated upstream commits do not cause duplicate runs.
• Formalver PRs and pushes select affected layers from the complete change range, including multi-commit pushes and both sides of renames. A Prolog requirements change runs Prolog; documentation runs no verification jobs. Shared generated inputs retain their dependent checks.
• Only successful upstream verification can propose the baseline-recording PR. Verification remains read-only and never moves the reviewed source pin.

Sandbox robustness improvements:

• Run dependency checks before installing toolchains or building Wasm.
• Upload both lockfiles, the selected SHA, a JSON mismatch report, and available test output as diagnostics.
• For an upstream build, adapt only RT-CODEHASH's expected artifact fingerprint. Export-surface and behavioral observations remain strict. Pinned runs retain the independent reviewed Wasm hash.
• Keep --locked; no automatic dependency relaxation or blind retries.

Validation:

• Eight Python regression tests cover upstream catch-up, exact permitted backports, future drift, checksum/source mismatches, diagnostics, and artifact-only observation adaptation.
• Watcher tests cover core/contract/build-input changes, unrelated projects, upstream sandbox/doc changes, pending PRs, and later unrelated versus real contract changes.
• Job-selection tests cover documentation, Prolog-only changes, complete PR/push ranges, renamed layers, and conservative fallback when the base is unavailable.
• Baseline-recording tests, Actionlint, ShellCheck, and whitespace checks pass.
• The checker reports zero mismatches across 343 shared packages against both the reviewed pin and upstream aa2e536; Cargo accepts the sandbox lockfile with offline, locked metadata.

The full Docker sandbox and proof suites were not rerun locally; CI must validate those execution paths.