docs: record standalone validation and publication policy

docs/VALIDATION.md

@@ -0,0 +1,55 @@
+# Initial standalone validation, 2026-09-12
+
+Implementation commit: `2a0fe1714b8ffb2e80203722bcb7987c630f432d`, signed by Nic Weyand.
+The subsequent completion documentation changes no runtime or packaging code.
+
+The baseline is Argand commit `47911062b00d87f215ba61c41965faf8a7f4b7f7`.
+All extracted Rust, migration and provider-license bytes match UPSTREAM.json.
+The extracted operator README changes only its working-directory instruction.
+New files provide independent build metadata, examples, policy and release tooling.
+The lockfile shrank from 642 packages to 246 with no new dependency versions.
+
+## Acceptance
+
+Linux x86_64, Rust/Cargo 1.98.1, Python 3.14, two Cargo build jobs. Passed:
+
+- Rust formatting, all-target compilation and Clippy with warnings denied.
+- All 23 Rust tests, zero failures or ignored tests; strict API documentation.
+- Eight Python source-release tests, Python syntax checks, shell syntax and
+  ShellCheck for the check script and every workflow shell step.
+- Native all-five-source fixture import, idempotency, alias lookup, explicit
+  identity joining, signed approval/activation, revocation and rollback refusal.
+- Identical native CLI, Rust library example and Python example lookup envelopes,
+  including provenance, attribution and multiple regional properties. Every
+  consumer refused an incorrect generation pin.
+- Two source archives and receipts from the implementation commit were byte-for-byte
+  identical. Receipt pin: `811af8fe2fd1e747b7745a44dba24e2397c01b43381e11846753e284caf6a275`.
+- Full acceptance rerun from the verified archive outside the Git checkout, then
+  from `/tmp` to exclude the developer's ancestor Cargo configuration. Neither
+  extracted copy had a `.git` directory or accessed Argand's source tree.
+
+The primary check took 28.24 seconds with 566,388 KiB peak process RSS after the
+initial compiler check. A separate optimized build took 84.15 seconds with
+602,340 KiB peak RSS. The archive check under `/tmp` took 101.64 seconds with
+569,228 KiB peak RSS, including recompilation. These are local single-run toolchain
+measurements, not serving-latency or full-provider capacity claims. Build output,
+fixtures, disposable keys and detailed logs were retained outside the repository.
+
+The final initial inventory was reviewed for credentials, private paths, datasets,
+unrelated files and provenance loss. Source archives exclude private-key and dataset
+extensions, symlinks, submodules, traversal paths and uncommitted changes. Tests
+exercise receipt/archive tampering, duplicate JSON keys, unsafe members and
+no-clobber output. All documentation links resolve locally.
+
+## Operational state
+
+The code is independently buildable. The public Forgejo repository requires
+signed commits and restricts direct pushes and merges to the maintainer; review
+rules apply to administrators. CI workflow commands were validated locally.
+Actions is disabled pending a dedicated isolated runner, so there is no hosted CI
+run or automatically produced remote artifact claim.
+
+No provider dataset was newly acquired, no production approval was fabricated,
+and no dataset timer, public Navigate route or registry generation was promoted.
+Argand's live source/build window remained with its beta agent. Its embedded
+registry dependency has not been replaced; docs/CONSUMERS.md describes cutover.