Guide operational evidence preparation and require two beacon operators

[mellowcroc]

Summary

• Require at least two distinct beacon operators; retain endpoint uniqueness, matching randomness and cryptographic verification.
• Discover original public evidence and report missing/conflicting records by phase and turn. Export an unsigned bundle only after complete verification.
• Let the coordinator sign the reviewed bundle only after evidence revalidation; final release still requires the signed bundle.

Validation

• Linux Docker: ceremony, CLI and operational-helper suites pass with reviewed vendor patches; scoped vet passes.
• Tests cover complete preparation, missing receipts, symlinks, tampered beacons, unsigned-bundle rejection, two-operator release verification, and CLI trust/required inputs.
• Repository-wide application/wallet tests were not run; production circuit and key profiles are unchanged.

Release order

Release proof-tool first. Update Relay pins and validate the published pairing before releasing Relay. Existing pinned ceremonies are not silently upgraded. Local fixture evidence does not establish independent operators or physical erasure.