Adopt canonical permission standard v1 + installer verification gate

scripts/install.sh

@@ -77,6 +77,31 @@ if (( copied != EXPECTED_COUNT )); then
   echo "ERROR: expected $EXPECTED_COUNT agent files, but installed $copied. Aborting." >&2
   exit 1
 fi
+
+# Decision-4 gate 1 — byte integrity: every installed file must be a faithful
+# copy of its repo source (install is cp -p, no transformation). Copy-all first,
+# verify-all after: a failure aborts with a nonzero exit and no success message.
+for src_path in "${AGENT_FILES[@]}"; do
+  name="$(basename "$src_path")"
+  if ! cmp -s "$src_path" "$TARGET/$name"; then
+    echo "ERROR: integrity check failed for '$name' ($TARGET/$name differs from $src_path). Aborting." >&2
+    exit 1
+  fi
+done
+
+# Decision-4 gate 2 — engine semantics: the installed definitions are only
+# trustworthy if the target opencode engine matches the documented matching
+# rules. Verifier exits: 0 = pass, 1 = engine drift, 2 = no usable runtime.
+echo "==> Verifying permission-engine semantics..."
+rc=0
+sh "$ROOT/scripts/verify-permission-patterns.sh" || rc=$?
+case "$rc" in
+  0) ;;
+  1) echo "ERROR: ENGINE DRIFT — opencode permission matching does NOT match documented semantics; installed definitions cannot be trusted. Aborting." >&2; exit 1 ;;
+  2) echo "ERROR: NO RUNTIME — no opencode binary found (set OPENCODE_BIN to override); install completed but CANNOT be verified. Aborting." >&2; exit 2 ;;
+  *) echo "ERROR: verifier exited unexpectedly (rc=$rc). Aborting." >&2; exit "$rc" ;;
+esac
+
 echo "==> Installed $copied/$EXPECTED_COUNT agents."
 
 if (( backed_up > 0 )); then