ADR-013 Phase 2: fix four bypasses found by adversarial review

An adversarial security review of the Phase 2 trust model found four real
bypasses (two remote-triggerable to in-process code execution). Root cause for
three: the set of bytes verification covered was smaller than the set that
determined execution. Fixes:

1. Bytecode-cache blind spot (CRITICAL). verify_dir excluded __pycache__/.pyc,
   so a planted cache ran while escaping the hash map. verify_dir now flags any
   bytecode as an unexpected file; the loader strips bytecode before verify and
   imports under sys.dont_write_bytecode, so only verified source executes.

2. Unauthenticated verify-at-load bypass (CRITICAL). load_plugin_class imported
   plugin.py with no gate, reachable via discover_available / an anonymous GET
   /api/plugins. The verify+strip gate moved INTO load_plugin_class - the single
   import choke point every path flows through - so an unsigned/tampered plugin
   is never imported. discover_available skips a refused plugin instead of 500.

3. Ungated migration entrypoints (HIGH). downgrade_plugin and get_current_head
   (ScriptDirectory imports version modules) ran plugin code with no check. All
   alembic-invoking methods now pass through _verify_ok (strip + verify) first
   and run under no-bytecode.

4. Revocation/content bypass (HIGH). The signed index bound a filename, not
   content; adopt did not bind the delivered bytes to the resolved version, so
   revoked bytes could be served under a live filename. The index now records a
   per-artifact SHA-256; adopt verifies the on-disk digest and requires the
   artifact's own signed manifest version to equal the resolved version.

Enforcement stays default-off; strip/no-bytecode run only under enforcement, so
the unsigned path is unchanged. 6 regression tests (planted bytecode, the
discover import path, downgrade gate, version-swap). 1054 pass, naming green.

tests/test_plugin_shelf.py

@@ -99,9 +99,10 @@ def test_resolve_highest_non_revoked(tmp_path, keypair):
     shelf_dir = _build_shelf(
         tmp_path, priv, [('demo', '1.0.0'), ('demo', '1.2.0')])
     index, _ = shelf.load_index(shelf_dir, [pub])
-    version, artifact = shelf.resolve_version(index, 'demo')
+    version, artifact, sha = shelf.resolve_version(index, 'demo')
     assert version == '1.2.0'
     assert artifact == 'demo-1.2.0.shopdbplugin'
+    assert sha and len(sha) == 64
 
 
 def test_resolve_skips_revoked(tmp_path, keypair):
@@ -110,7 +111,7 @@ def test_resolve_skips_revoked(tmp_path, keypair):
         tmp_path, priv, [('demo', '1.0.0'), ('demo', '1.2.0')],
         revoked=[{'name': 'demo', 'version': '1.2.0'}])
     index, _ = shelf.load_index(shelf_dir, [pub])
-    version, _ = shelf.resolve_version(index, 'demo')
+    version, _, _ = shelf.resolve_version(index, 'demo')
     assert version == '1.0.0'
 
 
@@ -178,3 +179,37 @@ def test_unpack_verified_wrong_name_refused(tmp_path, keypair):
     plugins_dir.mkdir()
     with pytest.raises(ValueError):
         shelf.unpack_verified(artifact, [pub], plugins_dir, 'somethingelse')
+
+
+def test_revoked_bytes_under_live_filename_refused(tmp_path, keypair):
+    """Finding #4: an attacker swaps the genuinely-signed bytes of a revoked
+    1.0.0 into the file named for the live 2.0.0. Adopt must refuse because the
+    artifact's own signed version (and content digest) do not match the resolved
+    version."""
+    priv, pub = keypair
+    shelf_dir = tmp_path / 'shelf'
+    shelf_dir.mkdir()
+    # pack both versions
+    for version in ('1.0.0', '2.0.0'):
+        src = _write_plugin(tmp_path / 'src' / version, version=version)
+        packaging.pack(src, priv, out_dir=shelf_dir)
+    # index revokes 1.0.0, records true digests for 2.0.0
+    shelf.build_index(shelf_dir, priv, 1,
+                      revoked=[{'name': 'demo', 'version': '1.0.0'}])
+    index, _ = shelf.load_index(shelf_dir, [pub])
+
+    resolved_version, artifact_name, expected_sha = shelf.resolve_version(
+        index, 'demo')
+    assert resolved_version == '2.0.0'
+
+    # attacker overwrites the 2.0.0 file with the signed 1.0.0 bytes
+    live = shelf_dir / artifact_name
+    (shelf_dir / 'demo-1.0.0.shopdbplugin').replace(live)
+
+    plugins_dir = tmp_path / 'live'
+    plugins_dir.mkdir()
+    with pytest.raises(ValueError):
+        shelf.unpack_verified(live, [pub], plugins_dir, 'demo',
+                              expected_version=resolved_version,
+                              expected_sha256=expected_sha)
+    assert not (plugins_dir / 'demo').exists()