Summary

• stabilize the search/news_digest happy path and align search-style intake contracts with the new direct SEARCHER flow
• land the storefront proof bundle, healthy English-first captures, proof-pack registry/index/gates, and front-door copy updates
• lighten the default local gate path while adding control-plane policy coverage for secret-scanning subfeatures

Test Plan

• python3 scripts/generate_storefront_proof_pack_index.py && npm run docs:check
• bash scripts/run_orchestrator_pytest.sh apps/orchestrator/tests/test_github_control_plane.py apps/orchestrator/tests/test_frontdoor_contract_gate.py apps/orchestrator/tests/test_generate_storefront_proof_pack_index.py apps/orchestrator/tests/test_storefront_proof_assets_gate.py apps/orchestrator/tests/test_news_digest_template.py apps/orchestrator/tests/test_scheduler_helpers.py apps/orchestrator/tests/test_search_web_strict.py apps/orchestrator/tests/test_tool_pipeline_integration.py apps/orchestrator/tests/test_intake_helpers_coverage.py -q
• CORTEXPILOT_HOST_COMPAT=1 bash scripts/pre_commit_quality_gate.sh
• npm run ci
• CORTEXPILOT_HOST_COMPAT=1 bash scripts/pre_push_quality_gate.sh

Breaking Changes

None

Rollout / Risk

• Risk level: Medium
• Remaining blocker: org-level code-security configuration attach still returns HTTP 403, so secret_scanning_non_provider_patterns and secret_scanning_validity_checks remain disabled on the live repo even though repo-side policy/checker now require them.
• Dependabot alert chore(deps): bump actions/checkout from 4.2.2 to 6.0.2 #1 (glib) was dismissed as not_used with a repo-side rationale because the alert is transitive through the unsupported Linux GTK/WebKitGTK desktop path while the public desktop support contract is macOS-only.