feat: add JD native read-only service surface

product-source/hololake-platform/guanghu-os/deployments/JD-FD-PRIMARY/NATIVE-READ-ONLY-SERVICE-SURFACE-QEMU-RECEIPT-20260815.hdlp

@@ -0,0 +1,33 @@
+schema: guanghu.jd-native-read-only-service-surface-qemu-receipt/v1
+receipt_id: GH-OS-JD-FD-PRIMARY-NATIVE-READ-ONLY-SERVICE-SURFACE-QEMU-20260815-001
+status: PASS_100
+observed_at: 2026-08-15T18:47:43+08:00
+node_id: JD-FD-PRIMARY
+source:
+  repository_id: REPO-014
+  accepted_repo_012_commit: fb1096c5ecdcfb36015d51273f487c2f36d9c9cd
+candidate:
+  sector_count: 29
+  sha256: 9807fa751616d4b421c103d60eecface1c5eb8013cbd89417ef9e027da281fb3
+  recovery_capability: QEMU_FIXTURE_ONLY_NOT_DEPLOYABLE
+verified:
+  native_anchor_http_qemu: 100
+  native_code_channel_read_only_qemu: 100
+  tcp_checksums: 100
+  exact_response_bodies: 100
+  protected_recovery_capability: 100
+  wrong_recovery_capability_ignored: 100
+truth_boundary:
+  native_physical_readback_this_cycle: 0
+  public_anchor_during_native_residency: 0
+  public_code_during_native_residency: 0
+  full_forgejo_equivalence: 0
+  default_boot_changed: false
+  bootloader_written: false
+  server_disk_written: false
+  server_rebooted: false
+why:
+  trigger: Native residency removed the Linux-hosted SSH and service data plane, causing public 502 responses.
+  decision: Prove a bounded native read-only surface before designing the authenticated BS-GZ-006 relay and public mapping.
+  rejected: Treating a Linux-hosted guard, a QEMU result, or a JSON snapshot as production service equivalence.
+next_action: IMPLEMENT_AUTHENTICATED_NATIVE_TO_BS_GZ_006_TRANSPORT_AND_SEPARATE_PUBLIC_ANCHOR_FROM_FULL_CODE_CHANNEL_ACCEPTANCE