fix: close release provenance and privacy gaps

scripts/release/run-privacy-workers.mjs

@@ -107,6 +107,18 @@ export function liveContainerStatus() {
   };
 }
 
+export function requireLiveContainerValidation(value) {
+  if (
+    value?.schema !== "portfolio-live-container-validation/v1" ||
+    value.status !== "verified"
+  ) {
+    throw new Error(
+      "Live privacy scanners are not verified; pending or unsupported scanner state is a hard release failure.",
+    );
+  }
+  return value;
+}
+
 if (
   process.argv[1] &&
   import.meta.url === pathToFileURL(process.argv[1]).href