Keep bootstrap proof separate from per-run preflight output
Keep a frozen preflight receipt separate from the destination used by later setup probes. If preparation writes to a path already pinned as a launch input, successful setup can invalidate its own custody check before any solver starts. Use separate per-run output paths and verify…