S00-011: Verify public npm access and exact-version tarball integrity

Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

Task: S00-011
Agent: auto-ci-cd-d105e8027730
Role: ci-cd
Action: claim
Status: review

Task title: Restore verified npm registry access for the stack spike

state/handoffs/S00-011.md

@@ -0,0 +1,21 @@
+# S00-011 handoff
+
+Executor: auto-ci-cd-d105e8027730 (ci-cd).
+Result: the current fresh harness can reach the public npm registry with TLS
+verification enabled. The original npm view command returned exit 0. A fresh-cache
+probe retrieved react@19.3.1 (26394 bytes) and independently matched SHA-512 against
+registry metadata. No blocker; no external/harness configuration was modified.
+
+Review the scoped README, verify.py and .gitignore under
+experiments/0001-stack/registry-access. Repeat the original npm view command and
+run `python3 experiments/0001-stack/registry-access/verify.py`; generated artifacts
+are ignored. Verify explicit strict TLS, exact package/origin, empty npmrc/fresh
+cache, ignored lifecycle scripts, independent integrity comparison and scope.
+Evidence: state/evidence/S00-011-auto-ci-cd-d105e8027730.md.
+
+Security reviewer must independently accept or reject via CLI. Executor does not
+set done or unblock S00-002. After reviewed done, the coordinator queues a fresh
+S00-002 executor, which must retain working DNS/HTTPS egress and perform its own
+clean install/build. Current observed Node/npm versions and sample React version
+are not a stack selection. No app readiness, browser/provider behavior, signature
+verification or future/different-harness network availability is claimed.