Re-verify stored claims on rerun and ship check-language

[samrusani]

Summary

• On-disk rerun and --render-only honor a stored claim only after the same claim_quote_is_verified check CI uses, against sibling evidence_sections (AUD-003).
• Screen stays substance-only. Missing evidence fail-closes. --render-only does not rewrite casefile.json.
• The language scanner ships in the wheel as coldscreen check-language. The checkout script is a thin wrapper. The package job runs the installed command on the demo memo (AUD-006).

Test plan

• 823 tests passed locally (was 812)
• ruff check, ruff format --check, mypy, python scripts/check_language.py
• CI 3.11 / 3.12 / 3.13, package, and audit
• Confirm fixtures and snapshot memos are unchanged
• Confirm a planted a fraud not in evidence fails --render-only, and the golden puffery quote still passes

[greptile-apps]

Greptile Summary

The PR re-verifies stored claim quotations against sibling evidence during on-disk reruns and packages the language scanner as a CLI command.

• Shares evidence-section reconstruction and quotation verification between rerun and scanner paths.
• Adds fail-closed rerun coverage for missing, mismatched, and tampered evidence.
• Moves the scanner implementation into the installable package while retaining a thin checkout wrapper.
• Adds an installed-wheel language check to package CI.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the changed behavior.

Current evidence writers and claim-source generation align with the shared verifier, rerun failure is intentionally fail-closed before file writes, and the packaged scanner preserves the prior invocation contract.

Important Files Changed

Filename	Overview
src/coldscreen/language.py	Adds shared evidence reconstruction and label-aware claim verification consistent with current deck and site evidence writers.
src/coldscreen/pipeline.py	Makes on-disk reruns pass sibling evidence into the memo language backstop and fail closed before writing.
src/coldscreen/check_language.py	Relocates the existing scanner into the installable package while reusing the shared verification helpers.
src/coldscreen/cli.py	Exposes the packaged scanner through a variadic check-language command and propagates its exit status.
scripts/check_language.py	Replaces the checkout-only implementation with a compatibility wrapper around the packaged scanner.
.github/workflows/ci.yml	Verifies that the installed wheel can run the language scanner against the packaged demo output.
tests/test_exemption_attacks.py	Adds regression coverage for tampered claims, missing evidence, wrong source labels, and valid verified quotations.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Load stored case file] --> B[Load sibling evidence sections]
  B --> C{Stored claim verifies against declared section?}
  C -- Yes --> D[Allow claim quote as span exemption]
  C -- No --> E[Do not exempt claim quote]
  D --> F[Render and scan memo]
  E --> F
  F --> G{Language backstop clean?}
  G -- Yes --> H[Write memo]
  G -- No --> I[Fail without rewriting files]

Loading

_{Reviews (1): Last reviewed commit: "Honor a stored claim on rerun only after..." | Re-trigger Greptile}