**Bound signed installer downloads to verified HTTPS**
Ignore inherited curl configuration, restrict redirects to HTTPS and
bound both release-file downloads before the existing signature gate.
Exercise the copied LXC and systemd recipes against real local TLS,
signed fixture installers and adverse transfer outcomes.
Contract-Neutral: Documentation-only transfer safety; no installer,
runtime, API or permission contract changes.
**Keep public installer verification keys out of fixture constants**
Replace only the recipe public-key field with the generated fixture
signer and reject missing or ambiguous verification keys. Preserve the
exact historical public-key findings without broadening any detector,
path allowlist or runtime trust rule.
Contract-Neutral: Test-only fixture substitution and exact historical
public-key false positives; no installer, runtime, API, permission or
secret-detection contract changes.
---
Fleet candidate `20261029T204028Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`b4aa640c4060b0a113f6e7b7cf5fe5d6649d6d1a` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
pulse-triage[bot]
eefdb38770