Phase 0 gates: every row typed in answers-check, lint ratchet, unservable lookup rows, full offline suite in CI

[SecureCloudGroup]

Round 19 execution plan, Phase 0: the publish-time gates the authoring loop will rely on. No record or answers file changes content.

What changes

• check_sample types every row and every column element. The first row of a list is still checked in full; in every later row and every column a present cell must hold its declared type, while a cell the row lacks is allowed (the app's sparse-row binding shows "—" for it). Until now list rows were typed on the first row only and columns not at all. All 254 answers files and the 32 recorded samples pass.
• answers-check --lint is a gate. Kind lints (minus the reasoned exemptions in lint_exempt.json, the same list the test suite applies through the new exempt_key) and utc lints fail. A keyword lint fails only when it is new against tests/fixtures/keyword_lint_baseline.json (474 held today): a ratchet, so the backlog can only shrink as sources are filed under their keywords. The tooling test asserts the gate passes on the repo's own data.
• evallookup reports unservable rows instead of failing on them. A row whose every accepted source is refused, failed or missing (the refused ESPN endpoints, an id that was never a record) is listed as unservable and not counted; a set that is entirely unservable never passes.
• CI runs the lint gate and the whole offline suite (answers rules, recorded samples, the asks overlap gate, taxonomy recall, resolvers, tooling) after the build so the built pack's tests run; gates the development lookup set; reports held-out and sealed. Held-out stood at 36/38 on 2026-10-06 (two top-3 hits: "when is the next jobs report", "tech news").
• Docs: current counts (8,672 sources, 310 curated from 140 providers, 129 subcategories, 254 with declared answers); packs described as sha256-pinned until Ed25519 signing lands (PLAN R12); SCHEMA.md states the all-rows rule.

Verified

sourcetool check clean; answers-check --lint 0 problems; 248 tests pass against a freshly built pack; lookup development 46/46, sealed 29/29, held-out 36/38, with 1/2/1 unservable rows reported.