run privacy and renderer probes in release gate

scripts/report_renderer_isolation_poc.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import argparse
 import tempfile
 import threading
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -78,4 +79,9 @@ def run_poc() -> dict[str, Any]:
 
 
 if __name__ == "__main__":
-    print(json.dumps(run_poc(), ensure_ascii=False, sort_keys=True))
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--strict", action="store_true", help="Return nonzero unless the isolation probe passes.")
+    args = parser.parse_args()
+    result = run_poc()
+    print(json.dumps(result, ensure_ascii=False, sort_keys=True))
+    raise SystemExit(0 if not args.strict or result["status"] == "pass" else 1)

scripts/run_quality_gate.py

@@ -391,6 +391,9 @@ def release_hygiene_check() -> None:
         }
         print(json.dumps(payload, ensure_ascii=False, indent=2), file=sys.stderr)
         raise SystemExit(1)
+    run([PYTHON, "scripts/public_release_privacy_scan.py", "--json"])
+    run([PYTHON, "scripts/report_renderer_isolation_poc.py", "--strict"])
+    run([PYTHON, "scripts/three_engine_parity_replay_validator.py", "references/oracle/three_engine_parity_replay_manifest.json"])
     print("release_hygiene_check ok: no release-critical product files are untracked")