[rovkinmax]

Summary

• Align the Puber profile and runtime/test pins with the qualified primary Kit source.
• Add isolated real-loader regressions for first-ingress to intent qualification and wrapper to shared provider loading, preserving foreign-cache fail-closed behavior.
• Update direct pin documentation and regenerate the existing source manifest; shared loaders, checkpoint, wrappers and canonical Janitor remain unchanged.

Qualification

• Exact seven-file D29 slice, source b5d80f3.
• All seven final affected Python suites passed, including 99 Janitor fixtures; exact-commit builder/source-binding checks passed.
• Two independent source/publication reviews passed; all 95 manifest source hashes verified.
• Original failing reproductions and corrected fixture attempts retained. runtime_attested remains false.
• Configured Task verifier remains BLOCKED by the missing genuine review context; unchanged product/build qualification is reused explicitly. No new local Gradle or actual provider/Task/cleanup operation.

Normal hosted CI is required. No admin bypass, release tag/package/store publication, installation or native Workflow activation is included; those rollout gates remain separate.