Validate final browser evidence without rewriting reviewed changes

Governance run 37016171545 rejected the original malformed timestamp even though a later reviewed receipt corrected it for identical runtime bytes. Use the existing fail-closed integration-range guard in CI while retaining per-commit canonical checks. Exercise the workflow shell with valid additive correction and invalid missing-base or unverified-content fixtures.

Change-source: pulse-maintainer

.github/workflows/canonical-governance.yml

@@ -130,16 +130,27 @@ jobs:
                 status=1
               fi
             fi
-            if ! git diff-tree --no-commit-id --name-only -r "${commit}" \
-              | python3 scripts/release_control/browser_verification_guard.py \
-                  --files-from-stdin --commit "${commit}"; then
-              echo "Browser verification guard failed for commit ${commit}."
-              status=1
-            fi
             echo "::endgroup::"
           done
           exit ${status}
 
+      - name: Validate final frontend browser evidence
+        shell: bash
+        env:
+          WORKFLOW_OUTPUT_1: ${{ steps.diff.outputs.range }}
+        run: |
+          set -euo pipefail
+          range="${WORKFLOW_OUTPUT_1}"
+          if [ -z "${range}" ]; then
+            printf '' | python3 scripts/release_control/browser_verification_guard.py --files-from-stdin
+            exit 0
+          fi
+          # Preserve reviewed commits: a later non-merge receipt can correct
+          # metadata for the same verified bytes. Require coverage of every
+          # final frontend path, including merge resolutions; never waive proof.
+          python3 scripts/release_control/browser_verification_guard.py \
+            --base "${range%%...*}" --commit "${range##*...}"
+
       - name: Validate Pulse Intelligence release-gate schema
         run: python3 scripts/release_control/pulse_intelligence_gate.py --validate-only --matrix docs/release-control/v6/internal/pulse-intelligence-release-gate.json