Added proof bundle and repair regressions

The proof bundle reproduces the public release-proof gate locally so contributors can validate trust-surface changes before pushing. Several regressions caught by the first bundle run are fixed in the same pass.