Thirteen tests behind skipif(not _lib_available()) had never executed in
CI, on any event, since the workflow was written. The two jobs each had
half of what was needed and neither had both:

  wire-format    runs `pytest tests` (the whole suite) but never builds
                 the Falcon C library, so every lib-gated test skipped.
  signature-kat  builds the library on 3 OSes but ran only
                 `pytest tests/test_signature_kat.py`.
  testnet-e2e    builds the library, runs no pytest, and is manual-gated.

The intersection was empty. The never-run set is not incidental - it is
where the constitution's hardest crypto rules are actually enforced:

  test_seal_wipes_private_key_buffer             S2.3 zeroization
  test_worker_stdout_carries_only_public_values  S2.3 no secrets in output
  test_isolated_result_has_no_private_key
  test_isolated_require_locked_fails_closed_when_mlockall_unavailable
  test_bad_build_fails_closed_without_consuming_cell
  test_seal_signature_verifies_and_has_0xBA_header
  test_second_seal_of_same_cell_raises
  test_isolated_seal_produces_verifying_signature
  test_isolated_second_seal_raises
  + 3 signature fuzzers and 1 interop cross-verify

Every green CI run has reported success while the private-key
zeroization check and the secret-leak-to-stdout check did not run.

This adds one step to signature-kat, the only job that builds the
library, running the full suite there.

The grep is not belt-and-braces, it is the substance: without it a failed
library build silently returns all thirteen tests to "skipped" and the job
goes green again, reintroducing this exact defect in the exact place it
was removed from. Passing must require that they RAN, not merely that
nothing failed. Same reasoning as TRELYAN_REQUIRE_KAT one step above,
which was applied to the KAT and never extended to its neighbours.

set -o pipefail so the tee does not swallow pytest's exit code.

Found by an adversarial sweep for claims that nothing mechanically
enforces; this was the highest-severity survivor.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The pinned build (ce15e75b = tag v0.1.0, the release go-algorand vendors)
has a confirmed size_t underflow in falcon_det1024_convert_compressed_to_ct
giving an unbounded read. TRELYAN's documented position is accept-and-
document, and it rests on exactly one fact: the SDK never binds that
function. The pin is deliberately NOT bumped - ce15e75b is the network's
release, and the untagged fix commit would make TRELYAN stricter than the
deployed on-chain verifier for no reachable benefit.

That makes the acceptance only as durable as the binding surface, and
nothing was watching it. A later commit adding CT-format support would
convert a documented non-issue into a live out-of-bounds read silently.

sdk/tests/test_binding_surface.py derives the bound symbol set by parsing
the AST of _bind() and compares it to a declared allowlist. Note this is
NOT the tautology it resembles: the two sides come from independent sources
- one parsed from the source, one the security policy - so it can fail. A
constant compared against itself cannot. The correct response to a failure
is to justify the binding, not to edit the allowlist green.

A second test sweeps all shipped sources textually, catching dynamic access
(getattr(lib, ...)) that the AST check on _bind() alone would miss. A third
asserts the extraction itself works, so the guard cannot pass vacuously.

Static only - no shared library is loaded, so it runs in the no-native-lib
CI job.

Verified by mutation, not just by passing: injecting
lib.falcon_det1024_convert_compressed_to_ct into _bind() turns both guards
red with the quarantine reason attached; reverting turns them green. Full
SDK suite 24 passed / 18 skipped (skips are the native-lib tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The deployed application has not matched the committed contract since
2ec798e (2026-06-16), and nothing could observe it. Three defects combined:

1. ci.yml filtered on sdk/** only, so no change under contracts/ ever
   triggered CI. inscription.py was edited, merged and released without a
   single test run.
2. verify_trelyan.py pinned EXPECTED_APPROVAL_SHA512_256 - a constant copied
   from the deployed program - and compared it to the chain. The contract
   blocks Update/Delete (I1/I5), so the deployed bytecode is immutable and
   that comparison cannot fail. It was a tautology reported as a PASS, and
   the weekly schedule has been re-proving it every Monday since June.
3. The pin was recorded 2026-06-17, one day AFTER the divergence, so it
   captured the superseded value.

Changes:

- contracts/verify_deployment.py (new): derives the expected bytecode by
  assembling the committed TEAL artifact and compares it to the deployed
  program. No stored expected hash. Exit 1 = drift, exit 2 = could not
  check; an unreachable node must read as neither agreement nor drift, and
  an unexpected crash exits 2 rather than masquerading as a finding.
  --compile-url lets a reviewer split the trust so one endpoint does not
  both assemble and serve. --recompile re-derives the TEAL from
  inscription.py so the artifact is not trusted either.
- ci.yml: add contracts/** to the path filters; add the contract-drift job.
- verify_trelyan.py: separate the two claims that were conflated. The pinned
  constant now asserts only "the app was not replaced", which is what it can
  actually support. Source correspondence is checked properly when the
  committed artifact is present, and reported as NOT CHECKED when it is not,
  rather than being silently covered by the weaker check.

Verified against live TestNet: drift detected (exit 1, committed source
builds to 112fcad3 / 667 B, chain serves d24d9071 / 660 B). The MATCH path
is reachable and was proven separately by round-tripping the deployed
program through algod disassemble/assemble (exit 0, byte-identical).

contract-drift and verify-live are both expected to be RED until the
committed contract is redeployed. That red is the finding, not a broken job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>