[pcvantol]

LANE_4 r3: qualify the sdist rebuild path

This is the bounded L4-WORKSPACE-SDIST-ROUNDTRIP-V1-20261001 pickup in Forge #208. The direct wheel from PR #36 passed its own installed gate, but an actual 2.4.1 sdist omitted product-version.json, so rebuilding a wheel from that archive failed with FileNotFoundError. The existing WPK-PACKAGE acceptance explicitly requires a usable sdist rebuild.

MANIFEST.in now includes the canonical version source. Required bash scripts/validate.sh builds both direct wheel and sdist, verifies source presence/version, rebuilds a wheel from the archive in a separate disposable environment, compares package files and role metadata with the direct wheel, and installs the rebuilt wheel non-editably outside the checkout. Negative tests reject missing sdist source and divergent rebuilt product bytes. Product version 2.4.2 is one PATCH operation under the existing policy. Owning backlog/roadmap/DAG text distinguishes this candidate from already merged local wheel evidence and the still-open public WPK parent.

Candidate evidence at 85373cf

• Before repair: actual 2.4.1 sdist rebuild failed because product-version.json was absent.
• bash scripts/validate.sh: PASS at 2.4.2, including strict per-file runtime coverage: __init__.py 8/8 (100%), cli.py 45/46 (97.83%), http.py 83/96 (86.46%), service.py 86/90 (95.56%).
• Direct wheel, sdist inspection, clean sdist-to-wheel rebuild, semantic product-file/metadata parity, fresh non-editable install, both role entrypoints: PASS.
• git diff --check: PASS. Independent read-only review at exact head 85373cf8007fedc44107dc5b4a4230414b4c66ac found no actionable issues; this is not a GitHub approval.
• Exact-head protected Foundation validation run 36895133854 and version-source check: SUCCESS. Non-blocking TDE observe run 36895133691: workflow SUCCESS; downloaded artifact reports assessment PASS_WITH_WARNINGS, repository qualification QUALIFIED, assessment_exit=1, qualification_exit=1, and coverage_evidence=not_available_for_foundation_only_repository. This is observation, not a runtime-TDE PASS.

This is neither bitwise reproducibility nor public namespace/publisher/release qualification. No peer source, production runtime, public registry, installer, Mission, reset, T0 or host service is changed. The first installer DoD remains unchanged.

Protected merge and main readback

PR #37 was protected squash-merged at d4fa4365786c38e8d8d0d62069665678a15a8abd; its source tree matches the reviewed head exactly. On this exact main, bash scripts/validate.sh passed again with the same strict per-file coverage, sdist rebuild, semantic wheel parity and fresh installed-role checks. Exact-main Workspace CI 36895373047 and canonical versioning 36895373061: SUCCESS. Non-blocking TDE observe 36895373069: workflow SUCCESS; artifact PASS_WITH_WARNINGS / QUALIFIED, assessment_exit=1, qualification_exit=1, and no TDE coverage evidence. This is still observation, not runtime-TDE qualification. WPK-IDENTITY, full WPK-PACKAGE and public release/readback remain open.