fix: pin model revisions and quarantine MariaDB CI routing

docs/redesign/phase-9/p9-sec-02/model/verify.py

@@ -0,0 +1,21 @@
+"""Verify committed qualification identities before loading an isolated model fixture."""
+from pathlib import Path
+import hashlib
+
+
+def verify_fixture(directory, manifest):
+    directory = Path(directory).resolve()
+    expected = set()
+    for entry in manifest['files']:
+        name = entry['file']
+        if Path(name).name != name or name in ('.', '..'):
+            raise ValueError('Artifact name escapes fixture directory.')
+        file = directory / name
+        if name in expected or file.is_symlink() or not file.is_file():
+            raise ValueError('Missing, duplicate or linked model artifact: ' + name)
+        expected.add(name)
+        if file.stat().st_size != entry['bytes'] or hashlib.sha256(file.read_bytes()).hexdigest() != entry['sha256']:
+            raise ValueError('Model artifact integrity mismatch: ' + name)
+    if not expected or {p.name for p in directory.iterdir()} - expected - {'manifest.json', 'generation.log'}:
+        raise ValueError('Unexpected artifact or empty manifest.')
+    return directory