[PascaleBeier]

Build native assistant releases with the application's canonical public skill archives, so discovery clients can consume the same five product procedures that the runtime serves. The trusted build runs cmd/skillpack from the exact app commit and includes its v0.2 index, five two-file archives, and app/packager provenance in the native package.

The receiver accepts only a complete legacy inventory or a complete public inventory. It checks archive digests, exact canonical bytes, member allowlists, regular non-executable modes, bounded sizes, and deterministic ZIP metadata, including the fixed UTC timestamp extra emitted by Go and the legacy empty extra. Attestation, producer-attempt binding, independent upstream verification, immutable refs, read-only aggregate MCP, retries, and backport behavior retain their existing owners and protections; downloaded package contents are never executed.

Validation performed November 2 against origin/main at 4feb218621f388d2be699805931357cef108781d:

• python3 -m unittest discover -s tests -v: 46 tests passed (105.683 seconds).
• Independent verification of the checked-in legacy distribution against source 3890a0b154cab2795ff1b474b1d1e6d57a71508d: passed independent verification of the checked-in legacy distribution.
• Repeated native packaging, cmp, and unzip -t: passed.
• claude plugin validate . and claude plugin validate plugins/hitkeep-analytics: passed; existing plugin directory warning for a missing icon.
• Real, unmocked producer integration against app commit 50b708079a28d9ebc3adffb94c8ca789dc543a35: two canonical syncs produced identical public files; repeated native ZIPs were identical; receiver unpack and independent upstream-byte verification passed.
• git diff --check origin/main...HEAD: passed; clean working tree and normal remote-push readback verified at 4f2c2f8d4bc917629bbfaf61748c6636b04c88d1.

Merge dependency: the app can pin this immutable branch commit for PR build preparation, but production delivery still requires packager_commit to be an ancestor of assistant main. Merge this PR preserving that exact commit before delivering an app release that consumes it; if this PR is squash-merged or rebased, update the app's immutable pin to the resulting reviewed main commit before release. The receiver must already contain this support when the new package inventory arrives. New builds also require the app commit to contain cmd/skillpack; complete historical packages remain accepted.

This PR prepares source only. No release, deployment, native-client installation, authenticated MCP session, or live payment was performed. Native MPP/x402/AP2 and Web Bot Auth remain unavailable and are outside this PR.
Companion PRs: application #449, website/docs #28, assistant skills #6, infrastructure #15. Integrate the assistant producer with a merge commit so the app's immutable pin remains an ancestor of assistant main. Runtime rollout and release publication remain separate.