fix(assessment): establish independent release trust

docs/CAPABILITY_AND_INFRASTRUCTURE_FIT.md

@@ -333,24 +333,42 @@ requirement changed.
 ### Repeatable release rerun
 
 The release-aware rerun tool validates the machine-readable assessment against
-its JSON Schema, verifies the catalog's Ed25519 signature and pinned keyring
-hash, compares catalog sequence and module versions, and—when local checkouts
-are available—checks that each annotated release tag still peels to the assessed
-commit. Release drift produces a machine-readable list of affected capability
-and infrastructure conclusions instead of silently carrying their prior status
+its JSON Schema, verifies the catalog's Ed25519 signature against an
+independently pinned local trust keyring, and separately verifies the canonical
+hash of the published or candidate keyring pinned by the signed catalog. The
+downloaded keyring is therefore never its own sole trust root. The tool compares
+catalog sequence and module versions and—when local checkouts are available—checks
+annotated release tags against assessed commits. For repositories represented in
+signed `release.selected_units`, both the peeled commit and annotated tag-object
+ID must match exactly; re-annotating an unchanged commit requires review.
+Release drift produces a machine-readable list of affected capability and
+infrastructure conclusions instead of silently carrying their prior status
 forward:
 
 ```bash
-./.venv/bin/python tools/assessments/capability-fit.py --public
+./.venv/bin/python tools/assessments/capability-fit.py \
+  --public \
+  --trusted-keyring /srv/govoplan/trust/catalog-keyring.json
 ```
 
-Use `--catalog PATH --keyring PATH` for an offline or release-candidate rerun and
-`--json` or `--output PATH` for automation. Exit status `0` means the assessed
-release metadata is current, `2` means explicit review is required, and `1`
-means the schema or trust checks are blocked. A successful rerun proves only the
-assessment schema, signed catalog metadata, and optional local tag provenance;
-it does not prove installed artifacts, target providers, target infrastructure,
-or production fitness. Those remain separate proof checks above.
+Use `--catalog CATALOG --keyring PUBLISHED_OR_CANDIDATE_KEYRING
+--trusted-keyring PINNED_LOCAL_KEYRING` for an offline or release-candidate
+rerun. `GOVOPLAN_MODULE_PACKAGE_CATALOG_TRUSTED_KEYS_FILE` may provide the
+independently managed local trust-root path instead. During key rotation this
+local file may contain both current and `next` keys within their validity
+windows; revoked, disabled and retired keys are rejected. Do not establish this
+trust file by downloading it in the same rerun. Public JSON responses are
+bounded to 16 MiB. Use `--json` or `--output PATH` for automation.
+
+Exit status `0` means the assessed release metadata is current, `2` means
+explicit review is required, and `1` means the schema or trust checks are
+blocked. The machine report distinguishes independent signature trust,
+published-keyring hash agreement, and local-tag proof. Local-tag proof is only
+marked checked when every composition entry is available for comparison and was
+attempted. A successful rerun proves only the assessment schema, signed catalog
+metadata, published-keyring integrity and optional local tag provenance; it does
+not prove installed artifacts, target providers, target infrastructure, or
+production fitness. Those remain separate proof checks above.
 
 ## Evidence used in this slice
 
@@ -365,7 +383,8 @@ or production fitness. Those remain separate proof checks above.
   Files, Mail, Audit and Addresses tests
 - [Campaign delivery runbook](https://git.add-ideas.de/add-ideas/govoplan-campaign/src/branch/main/docs/CAMPAIGN_DELIVERY_RUNBOOK.md)
 - [Live signed stable catalog](https://govoplan.add-ideas.de/catalogs/v1/channels/stable.json)
-  and [trusted keyring](https://govoplan.add-ideas.de/catalogs/v1/keyring.json)
+  and [published keyring](https://govoplan.add-ideas.de/catalogs/v1/keyring.json),
+  verified against a separately provisioned local trust keyring
 - Annotated source tags `govoplan-core/v0.1.13` and
   `govoplan-campaign/v0.1.10`, including their catalogued Python and WebUI refs