feat(pre-push-safety-net): reproduce evaluated Joern runtime

.kiro/specs/pre-push-safety-net/tasks.md

@@ -22,12 +22,13 @@ started with group 1 (tasks 1.1–1.4); each task remains pending until independ
   shared backend/driver, cache and report edits otherwise remain serial. No optional acceptance tests.
 
 - [ ] 1. Establish the runtime, evaluation inputs and shared contracts
-- [ ] 1.1 Reproduce the evaluated engine environment
+- [x] 1.1 Reproduce the evaluated engine environment
   - Align the shipped image, Compose and host-install defaults with Joern 4.0.625; preserve version override and checksum verification.
   - Exercise PHP with the native interpreter and the installed JavaScript frontend; open a source and the frontend parser where applicable, recording byte counts and graph census.
   - Done when a local image smoke produces valid small PHP and JavaScript graph/query payloads with recorded versions, and an unreadable source fails explicitly. This builds locally; it does not deploy.
   - _Boundary: Cache and Engine Boundary, packaging integration_
   - _Requirements: 7.1, 7.3, 8.2_
+  - _Verified 2026-09-12:_ independent review APPROVED; 888 tests passed, 9 skipped. Actual local image PHP/JavaScript graph census and source witnesses passed, unreadable PHP explicitly refused. Parent verified current provenance hashes, image identity, non-root user and CLI/frontend liveness. Evidence: `benchmarks/measurements/2026-09-12-engine-runtime-smoke.json`. Runtime readiness only; no hook latency/detection claim. Existing mypy errors in `model/scan.py` at 299/302/310 remain unchanged.
 - [ ] 1.2 Prepare labeled development and reserved evaluation changes
   - Pin a readable PMPro change/fix and a supported Node/Express change/fix, plus benign controls; verify license and source bytes before accepting recipes.
   - Use NodeGoat only if its selected mechanism fits a current arbiter; label authored repairs as authored. Reserve an independently selected Node API repository with modern module/async context and reviewable history before tuning on transfer results.

.kiro/steering/roadmap.md

@@ -25,7 +25,7 @@ engine are out of scope.
   VAmPI 16. `<50` remains unmet; VAmPI's transitive SQLI is not measured by this position metric.
 - Equal-score tie-breaking alone cannot bring PMPro or WP Statistics under 50. The existing
   ranker is useful, but its measured ordering is not enabled by the ordinary CLI caller.
-- Docker/Compose/ops still default to 4.0.623. Pin and provenance alignment precede deployment claims.
+- Docker/Compose/ops now default to 4.0.625; task 1.1 passed local PHP/JavaScript image smoke and independent review. No host deployment or hook latency claim follows from that runtime evidence.
 - `contributor-scan` has 24/40 checked tasks; historical checkboxes are not rewritten by this review.
   `flow-aware-ranking` is still an unapproved brief despite implementation history.