[ORESoftware]

Current-main successor to stale #384.

This rebuilds only the still-valid product delta on current main (2489d1f6378c57cd5c2a866c359c94b7efb3cb18):

• published-artifact smoke validates .zpkg.toml without requiring a .zpkg.lock that the package does not publish;
• tests/toml_contract.rs enforces the intended authority split: .zpkg.toml stays within the zed-interfaces Manifest schema while .cli-flags.toml remains a separate first-class CLI contract.

No generated lockfile, stale Cargo state, or superseded source cleanup was replayed from #384. The branch was created from the current main tip and the two edits were reapplied semantically.

Merge gate: fresh exact-head checks. Runnerless/zero-step Actions caused only by unavailable build minutes may be treated as unavailable evidence; any substantive executed failure remains a blocker.

[ORESoftware]

Successor audit at c30075d76a8ea4a5eae641142f8f53fd54dc7115: the reduced two-file scope is clean and several relevant lanes pass (Zed package graph, candidate smoke, ores-lint, polyglot, develop-shell, formal review, copy-mode OCI). Promotion is still blocked because ci, CLI portability, repository hardening, fp-conformance, latest-deps, zed-tip canary, and global executable profiles executed and failed. These are substantive runs, not zero-step/minutes exhaustion, so keep #418 open and do not revive stale #384.

[ORESoftware]

Current-main reconciliation note: PR #419 has now merged to main at e0230b6a6cdca847d66604d9e35d6f44495045b8, and this successor is presently reported mergeable=false. Preserve this PR's intentionally narrow two-file delta (.zpkg.toml published-smoke behavior + tests/toml_contract.rs authority-boundary regression) and semantically refresh it onto the new main; do not replay stale #384 Cargo/generated history. After refresh, re-evaluate exact-head checks. Runnerless/zero-step GHA may be treated as unavailable evidence per current merge policy, but executed failures remain blockers.

[ORESoftware]

Superseded by #422. The successor was rebuilt directly from current main@bbd24936796bb19231299f69a19cf4152f8da5db and preserves only this PR's intended two-file delta (.zpkg.toml published smoke + tests/toml_contract.rs authority boundary), avoiding stale/conflicting branch history. Closing this PR so #422 is the single canonical merge path.

[ORESoftware]

Superseded by current-main successor #422. #422 was rebuilt from main@bbd24936796bb19231299f69a19cf4152f8da5db and carries only the two still-valid product changes: published-artifact smoke no longer requires an unpublished .zpkg.lock, and the TOML contract test preserves .cli-flags.toml as a separate first-class CLI contract. Closing this older carrier avoids retaining stale branch ancestry and unrelated workflow state.