fix(graph): enforce authoritative immutable downloads

[ORESoftware]

Summary

Follow-up hardening for #264 after its original head merged:

• pins the merged protected-visibility graph contract (zed-interfaces@7d31f80dd8a310f218931165a3ad636a2f32b932) in Cargo and every relevant workflow
• requires X-Zpkg-Graph-Authoritative and verifies its value against the requested format
• requires Content-Length, enforces the client limit before reading, and rejects bodies whose exact length differs
• tightens strong ETag grammar and adds focused regression tests
• makes the package-graph validation gate check exact interface provenance

Exact-head evidence

Head: b59e3a455431615a06c4b9255fdf5f3e823de6ba

All 25 exact-head workflows are green, including macOS Nix and Chromium, Firefox, and WebKit browser jobs. The branch's earlier self-modifying helper has been removed; the current 21-file diff contains no write-enabled helper workflow.

Local evidence

• bash scripts/validate-zed-package-graph.sh
• shell syntax and exact-pin parity checks
• git diff --check

Merge dependency

Keep this draft until the API follow-up that supplies the required authority and selected-representation length metadata has its persistence dependency promoted. The CLI head itself is fully green.

Related: DEN-3472, DEN-3478.

[ORESoftware]

Exact-head correction: a concurrent branch-only helper (cf9b6a7…) attempted to self-rewrite the reviewed interface pin with contents: write, which canceled the legitimate macOS retry and failed repository hardening. The helper was removed at 19430d1…; no self-modifying workflow is present in the 21-file PR diff.

The current explicit follow-up c21c3a9bc7825ff8ca068c4c1178e88774b5de69 now pins the canonical merged-main interface commit 15577e17a820c3b2b1a39ee178d4645185309a05. I verified that commit and the reviewed feature head 4d40ae96… both point to tree 21128f2470bd86070682a4b8ba0b6b20c876f85d; this is provenance-only. Exact-head checks have restarted.

[ORESoftware]

Final audit complete on b59e3a455431615a06c4b9255fdf5f3e823de6ba: authoritative graph metadata, strict media/length/ETag validation, atomic no-clobber downloads, protobuf/CSV coverage, and the merged zed-interfaces contract pin are all present. Focused graph tests passed locally (14/14), and the full GitHub Actions matrix is green across Linux, macOS, Windows, browser, Nix, polyglot, locking, and repository-hardening jobs.

[linear-code]

DEN-3530