The deployed application has not matched the committed contract since
2ec798e (2026-06-16), and nothing could observe it. Three defects combined:

1. ci.yml filtered on sdk/** only, so no change under contracts/ ever
   triggered CI. inscription.py was edited, merged and released without a
   single test run.
2. verify_trelyan.py pinned EXPECTED_APPROVAL_SHA512_256 - a constant copied
   from the deployed program - and compared it to the chain. The contract
   blocks Update/Delete (I1/I5), so the deployed bytecode is immutable and
   that comparison cannot fail. It was a tautology reported as a PASS, and
   the weekly schedule has been re-proving it every Monday since June.
3. The pin was recorded 2026-06-17, one day AFTER the divergence, so it
   captured the superseded value.

Changes:

- contracts/verify_deployment.py (new): derives the expected bytecode by
  assembling the committed TEAL artifact and compares it to the deployed
  program. No stored expected hash. Exit 1 = drift, exit 2 = could not
  check; an unreachable node must read as neither agreement nor drift, and
  an unexpected crash exits 2 rather than masquerading as a finding.
  --compile-url lets a reviewer split the trust so one endpoint does not
  both assemble and serve. --recompile re-derives the TEAL from
  inscription.py so the artifact is not trusted either.
- ci.yml: add contracts/** to the path filters; add the contract-drift job.
- verify_trelyan.py: separate the two claims that were conflated. The pinned
  constant now asserts only "the app was not replaced", which is what it can
  actually support. Source correspondence is checked properly when the
  committed artifact is present, and reported as NOT CHECKED when it is not,
  rather than being silently covered by the weaker check.

Verified against live TestNet: drift detected (exit 1, committed source
builds to 112fcad3 / 667 B, chain serves d24d9071 / 660 B). The MATCH path
is reachable and was proven separately by round-tripping the deployed
program through algod disassemble/assemble (exit 0, byte-identical).

contract-drift and verify-live are both expected to be RED until the
committed contract is redeployed. That red is the finding, not a broken job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/4.1.1...4.3.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>