Issue: incomplete release evidence can look ready

Bounded problem

The release command must not accept a candidate when a required check failed, is missing, has no evidence, or appears twice. Invalid JSON must remain distinguishable from a valid candidate that is not ready.

This reference solution resolves the issue. A learner can use the acceptance contract below to reproduce the work with a fresh branch and a test-first change.

Acceptance contract

• A candidate with passing tests, security, and package checks exits 0 and reports ready: true.
• A valid but incomplete candidate exits 1, reports ready: false, and lists every observed problem.
• Malformed JSON exits 2 and writes the parse error to standard error.
• Duplicate check names fail even if one duplicate contains passing evidence.
• The case-insensitive markers UNKNOWN, failed, not executed, unverified, NOT RUN, and no retained output fail because they do not identify a retained result.
• The tests run through node:test without third-party packages or network access.

Exclusions

The CLI does not authenticate to a registry, execute evidence strings, publish packages, build containers, or prove that an external deployment succeeded. Those actions remain outside this issue.

Proof locations

• Behavior: test/cli.test.mjs
• Hook boundary: test/release-guard.test.mjs
• Final record: evidence/PROOF-LOG.md