Fail closed when installing MCP binaries

Verify the signed release checksum manifest against Pulse's pinned SSH key before either MCP installer accepts a downloaded binary. Remove the unsigned bypass and require one exact digest entry.

Include bare Unix MCP executables in release checksum/signature assembly, cover unavailable, invalid, ambiguous, mismatched, and successful evidence paths with executable regression tests, and enforce MCP installer pins against the configured release key.

docs/AGENT_SUBSTRATE.md

@@ -71,8 +71,10 @@ outcome without polling the audit endpoint.
   notifications on the stdio channel, which lets an autonomous MCP-bound agent
   react to push events without holding a separate HTTP connection. The
   one-line installers `install-mcp.sh` and `install-mcp.ps1` fetch the
-  matching binary from the latest Pulse release and verify its checksum.
-  Building from source stays available.
+  matching binary from the latest Pulse release, verify the checksum manifest
+  against Pulse's pinned release key, and then verify the binary's checksum.
+  They refuse installation when any integrity evidence is unavailable or
+  invalid. Building from source stays available.
 
 - **`cmd/agent-probe`** is a small Go binary that walks the discovery,
   triage, depth, and push flow against a running instance. Use it as a smoke

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -3301,7 +3301,9 @@ used by Pulse Assistant to OpenCode, Claude Desktop, Claude Code, or
 other MCP-speaking clients. The installers fetch a published
 `pulse-mcp-<os>-<arch>` binary from the latest GitHub Release,
 verify SHA256 against the same `checksums.txt` the rest of the
-release uses, and place the binary at `~/.local/bin/pulse-mcp`
+release uses, first verifying `checksums.txt.sshsig` against the pinned
+Pulse release key and failing closed if either integrity artifact is missing,
+invalid, or ambiguous, and place the binary at `~/.local/bin/pulse-mcp`
 (Unix) or `$LOCALAPPDATA\pulse-mcp\pulse-mcp.exe` (Windows). The
 binary takes no version ldflags because it reads the manifest
 from the Pulse instance it points at. `scripts/build-release.sh`
@@ -3316,7 +3318,7 @@ and `.../install-mcp.sh` are stable redirect targets the
 installers consume. macOS notarization is intentionally skipped
 for v1: the README documents the Gatekeeper bypass and the
 install-script flow downloads the same unsigned binary, with the
-audit trail of SHA256 verification preserved.
+audit trail of signed-manifest and SHA256 verification preserved.
 The adapter's complete request/response tool-list projection, manifest
 projection, capability and governance metadata formatting, request/response
 tool filtering, typed input-schema projection, and API route/body call