Guard, gate and records

The guard refuses any Poly that has $d$ as a generator. $d$ inside the coefficient domain is admitted, as used by the XVI-P integral library. apart and apart_list are removed from the allow-list. 18 bypass forms $\times$ 4 expressions are probed, and all of them raise.

The gate compares every Q01/Q02 certificate value path by path against q02_expected.json, whose sha256 is pinned in the gate. It independently checks the O.2(c) cells (exact set, all true, ${\kappa }^0$..${\kappa }^2$, including the build input), each per-file pin, the conventions files and the errata file, and fails closed.

tools/build.py no longer syncs by default; a release opts in with –sync.

The registration record, errata E2 (severity low) and E4 (unpinned p23_conventions) are corrected, and the XVI-N label note (r10 file, r12 content) is added.