feat(assessment): gate signed release drift

docs/CAPABILITY_AND_INFRASTRUCTURE_FIT.md

@@ -330,6 +330,28 @@ assumptions, gaps, risks, recommendation and proof check. Reassessment must pin
 new composition and review any row whose code, evidence, configuration or target
 requirement changed.
 
+### Repeatable release rerun
+
+The release-aware rerun tool validates the machine-readable assessment against
+its JSON Schema, verifies the catalog's Ed25519 signature and pinned keyring
+hash, compares catalog sequence and module versions, and—when local checkouts
+are available—checks that each annotated release tag still peels to the assessed
+commit. Release drift produces a machine-readable list of affected capability
+and infrastructure conclusions instead of silently carrying their prior status
+forward:
+
+```bash
+./.venv/bin/python tools/assessments/capability-fit.py --public
+```
+
+Use `--catalog PATH --keyring PATH` for an offline or release-candidate rerun and
+`--json` or `--output PATH` for automation. Exit status `0` means the assessed
+release metadata is current, `2` means explicit review is required, and `1`
+means the schema or trust checks are blocked. A successful rerun proves only the
+assessment schema, signed catalog metadata, and optional local tag provenance;
+it does not prove installed artifacts, target providers, target infrastructure,
+or production fitness. Those remain separate proof checks above.
+
 ## Evidence used in this slice
 
 - [Production-like profile](../dev/production-like/README.md) and