[jeffreyaven]

Summary

• Add a stdlib-only signed-provider checker for the coordinated ML-DSA migration.
• Read provider metadata and every service with nopVerify:false, fresh CLI processes and an isolated application root; never reuse or terminate a shared server.
• Treat stderr query errors as failures even when StackQL exits zero; reject empty/malformed metadata output.
• Document the existing runner's signed mode and add focused CI tests. The registry still actively uses this repo.

Validation

• Four unit tests pass.
• Actual migrated StackQL: a signed fixture passes (one service/one resource); its unsigned counterpart fails with the signature error.

Coordination: merge methods and release order

1. Merge this PR first (squash is fine).
2. Merge verify-ml-dsa-provider-documents any-sdk#155 and verify-ml-dsa-provider-documents stackql-labs/omnisdk#23 in parallel with CREATE A MERGE COMMIT, not squash/rebase, to retain release tags v0.6.1-beta02 and v0.1.7-alpha01 in main.
3. SQUASH AND MERGE wire-ml-dsa-provider-verification stackql#869, then publish the binary. Confirm https://releases.stackql.io/stackql/latest/stackql_linux_amd64.zip supplies the new build.
4. Merge ml-dsa-provider-signatures stackql-provider-registry#487 LAST with CREATE A MERGE COMMIT to preserve signing/v0.1.0-alpha01 in main; then explicitly close registry issue #482 (its default branch is dev).

All required CI and reviews must pass before merging. The existing local runner/.gitignore edits remain excluded. Four checker unit tests passed in CI, and actual migrated CLI integration accepted signed fixtures and rejected unsigned ones. All tagged-library/core CI is now green; the complete core Robot matrix passed with named semver releases: https://github.com/stackql/stackql/actions/runs/40050605476. This checker PR is unchanged and green.