Publish pinned public SDLC checker distribution

.github/workflows/sdlc-checker-distribution.yml

@@ -0,0 +1,24 @@
+name: Verify public SDLC checker distribution
+on:
+  pull_request:
+    paths:
+      - 'scripts/sdlc/**'
+      - '.github/workflows/sdlc-checker-distribution.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'scripts/sdlc/**'
+      - '.github/workflows/sdlc-checker-distribution.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  verify:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Verify pinned source artifact and public consumer
+        run: |
+          cd scripts/sdlc
+          sha256sum -c SHA256SUMS
+          python3 verify-public.py

scripts/sdlc/README.md

@@ -0,0 +1,12 @@
+# Hypershell SDLC checker (public distribution)
+
+This is a checked, derived copy of the one canonical checker maintained in the private `X1pheR/hypershell-infrastructure` repository, not a second checker implementation.
+
+- Canonical source: `0c26d43d47c14d0a1d0da1be4b61d43f9ff71707`
+- Private merge: `6f5a51eafdcc9df4039a79f3c2920845661f7cd8`
+- License: MIT, included in the script
+- Runtime: Python 3.12+ and Git, no pip dependencies for the public mode
+
+Verify `sha256sum -c SHA256SUMS`, then run `python3 sdlc-conformance.py --public-repo /path/to/checkout --json`.
+
+Exit 0: static public patch register passes; exit 1: fail-closed finding; exit 2: invalid invocation. The source-owned `pr_state` field is not live GitHub evidence. This checker does not verify release inclusion, private ADRs, source/runtime parity or production. Private exception metadata is never distributed. Pin an immutable `resources` commit plus this artifact SHA-256 before use; subsequent artifacts must be produced from the canonical infrastructure owner.

scripts/sdlc/SHA256SUMS

@@ -0,0 +1 @@
+95241d2d173c695ff80cfaec5275493d9f8452d52c202e68ceaaac6ecc4eb0cc  sdlc-conformance.py