Advisory: run BootProof in CI, report honest PR verdicts, retain evidence.
For merge enforcement, use Receipt Gate.