docs(ri-050): registry credential proven — pipeline 2517 green at build-gateway (#1275)

docs/release-integrity/release-evidence.md

@@ -1,6 +1,6 @@
 # RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor)
 
-> Status: **DRAFT — final proof pending**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z (see infrastructure item below). Remaining for closure: one fully-green post-fix push pipeline — **this pack's own merge to `next` is that proof event**, its pipeline number recorded in the #1275 closure comment. Last updated 2026-08-18 by fargo (day-takeover orchestrator).
+> Status: **DRAFT — proof complete, awaiting review + merge**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z and **proven end-to-end**: push pipeline **2517** (retry of failed 2512 at the identical commit d4d32a8, only the secret changed between runs) — all steps green including `build-gateway`. Remaining for closure: this pack PR reviewed (topher), merged to `next`, its own push pipeline green, #1275 closed. Last updated 2026-08-19 by fargo (day-takeover orchestrator).
 > Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source:
 > `docs/PRD.md` § Release Integrity Workstream (#1275).
 
@@ -68,14 +68,18 @@ in the Gitea container; minting with a token is forbidden server-side). Events
 `[push, tag]` preserved. Verified **without a pipeline run**:
 `POST /v2/<pkg>/blobs/uploads/` opened then cancelled a session — **202** on
 all four kaniko destinations (gateway, appservice, web, ci-base), anonymous
-control **401**, wrong-owner control **401**. Not verified: stored-secret
-byte-intactness (Woodpecker never returns secret values). First post-fix push
-on `next` is the end-to-end proof; per the pack status line above, that is
-this PR's own merge pipeline. If `build-gateway` is still red with this
-credential proven good, the fault is in the step, not the secret — do not
-re-mint on that evidence. The earlier "Requires a package-scoped token
-(Jason)" expectation is superseded: the defect was a stale value from the org
-rename, not a scope grant Jason owed.
+control **401**, wrong-owner control **401**. The earlier "Requires a
+package-scoped token (Jason)" expectation is superseded: the defect was a
+stale value from the org rename, not a scope grant Jason owed.
+
+**Proof 2026-08-19 ~00:2xZ (fargo): pipeline 2517 green at build-gateway.**
+Woodpecker retry of 2512 — identical commit d4d32a8, identical pipeline
+config, only the server-side secret changed between runs — went green on
+every step (clone, install, verify, build, publish-next-npm,
+**build-gateway**). A/B at the same commit isolates the credential as the
+variable; the stored value is byte-intact. Retry was serialized (sole run in
+flight; merge-purpose CI queue guard had blocked on 2512's terminal failure
+at the `next` head, which this retry also clears). The item is closed.
 
 ## Process record (audit trail)