- verify/preflight resolve `command -v claude` and fail when PATH reaches an
ungated binary (vendor installer puts ~/.local/bin ahead of /usr/local/bin)
- add --native-path (CLI + installer): gate ~/.local/bin/claude, pin the
versioned target, follow vendor updates, restore on uninstall, and export
DISABLE_AUTOUPDATER=1 so a background update cannot replace the gate
- zero-to-deployed: vendor 4 GB minimum, base packages, swap, boot-persistent
proxy, DNS scope, real login mechanics, claude doctor ordering, rollback
- templates/evidence.md; 52 self-tests