ci: re-vendor hardened chain_feed.py and adopt the absolute CHAIN_PY resolver fragment - #99

Summary

• Re-vendors .github/scripts/chain_feed.py byte-identically from ai-game-dev-software origin/chain-testing (PR #955, merge a2770602, the security-hardened version). Git-blob sha256 775fb1a365a41daaf536faf8b0dbcc2057406a1e5138d430a3b2d881918b6d38, verified on the staged index blob.
• Adopts the new fragment. The old chain python (posix) resolver is replaced with the verbatim python .github/scripts/chain_feed.py print-fragment --node reflectornet posix and windows resolver steps. They export an absolute, space-free CHAIN_PY (the probe prints sys.executable) and never use bare py. Both chain steps (chain feed, chain leg record) invoke ${{ env.CHAIN_PY }}. No job-level CHAIN_PY is set. A mechanical check confirmed the 27 resolver lines match the fragment output exactly.
• Adds .gitattributes with .github/scripts/chain_feed.py text eol=lf. The repo had none, and core.autocrlf=true checkouts would otherwise break byte parity.

No CLI flag, exit code or leg-record field changed. record --warn still drops a blank value, so the existing CHAIN_PACK_EVIDENCE wiring is unchanged.

Chain dispatch evidence (final head 34e42654e0f200e7d474db255f2d9537cdf02b38)

• Lock: built with software origin/chain-testing tooling (a2770602, manifest sha256 c00bd189…): chain.py lock --set all=main --set reflectornet=branch:worktree-01a09e57-966f-70d3-8838-d8fa1f249a8a. Result: lock_hash sha256:aa453ff962367bdecbdac2a3d2dd8b15d84a6c89fbf8a7f1efa738fba862df2b, reflectornet 34e42654.
• Dispatch run: 34809827418. Captured by displayTitle == "chain aa453ff9 reflectornet", headSha == 34e42654…, and a run id not present before dispatch. Conclusion: success.
• CHAIN_PY resolved to /usr/bin/python3 (absolute, space-free). Log: chain: sha ok 34e42654… == lock.nodes.reflectornet.sha.
• Identity row: {package: com.IvanMurzak.ReflectorNet, resolved: 5.4.0-ws.g34e42654, expected: 5.4.0-ws.g34e42654, ok: true}. The source is com.IvanMurzak.ReflectorNet.5.4.0-ws.g34e42654.nupkg!lib/netstandard2.1/ReflectorNet.dll, ProductVersion 5.4.0-ws.g34e42654+34e42654…. Leg result: green, 1 proof, 0 failing.
• Artifacts (owner rule 2026-09-14: only the small JSON leg record, retention-days: 1): chain-leg-reflectornet-linux-build-and-test, 760 bytes zipped (chain-leg.json is 1264 bytes), expires 2026-09-15. The nupkg (298433 bytes, sha256 f120fafa…) is not uploaded; it appears only in warnings[]. The ordinary PR run 34809699088 uploaded 0 artifacts.

PR CI on head

Check runs on 34e42654: build-and-test success (run 34809699088, pull_request), build-and-test success (run 34809827418, workflow_dispatch), Test Results success.

Test plan

• Target-specific local tests passed (see profile test.md)
  • Suite 1, ReflectorNet xUnit: 1551/1551 on net8.0 and net9.0.
  • Suite 2, MCP-Plugin-dotnet consumer tests against a local 5.4.0-dev-64ac573-* pack: McpPlugin.Tests 821/821 and McpPlugin.Server.Tests 1023/1023 on both TFMs.
  • Suite 3, Unity EditMode: skipped. The diff is CI config only.
• One positive chain dispatch on the final head is green, with identity ok (above)