_vfscommon.vfs punkshell.ico sidecar: kit-shipping call made

User-approved resolution of the open call recorded at G-135 achievement:
src/vfs/_vfscommon.vfs/punkshell.ico gains its assetorigin sidecar
(schema 1, hash equals source_hash - byte-identical derived copy of
src/assets/logo/punk-mark.ico, source recorded ../../-relative). The
sidecar is root-level user-curated payload beside the icon itself
(vfscommonupdate regenerates the modules/lib subtrees, not these), and
ships inside every kit that merges the common payload from that kit's
next bake; inside a kit the recorded source is absent, so a checker
truthfully reports source-absent there while still hash-confirming the
icon bytes - in this tree it verifies (assetorigin_check: 9 records, 9
verified). The per-kit mkzipfix.vfs / punk8_statictwapi.vfs copies stay
unrecorded (no decision requested; unrecorded is silent and supported).

src/assets/logo/AGENTS.md ownership bullet and the G-057 handoff note
updated to record the made call. No bake run - deployed kits pick the
sidecar up when next baked.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

goals/G-057-kit-icon-embedding.md

@@ -141,10 +141,13 @@ delete-then-write). Requirements sketch agreed 2026-07-10:
   (src/assets/logo/AGENTS.md "Provenance records"), the checker
   (scriptlib/developer/assetorigin_check.tcl), and a verified derived-copy
   sidecar beside this goal's default icon at src/runtime/punkshell.ico (hash
-  equals source_hash, source ../assets/logo/punk-mark.ico). Its notes also
-  carry the still-open user call this goal will meet at bake time: whether the
-  _vfscommon.vfs / per-kit vfs punkshell.ico copies get sidecars, which would
-  ship inside every baked kit.
+  equals source_hash, source ../assets/logo/punk-mark.ico). The kit-shipping
+  call its notes carried is now made (user-approved 2026-07-28):
+  src/vfs/_vfscommon.vfs/punkshell.ico carries a sidecar that ships inside
+  every kit merging the common payload from that kit's next bake - inside a
+  kit it truthfully reads source-absent (bytes hash-confirmed, source not
+  shipped). The per-kit mkzipfix.vfs / punk8_statictwapi.vfs copies stay
+  unrecorded.
 - The sidecar is the natural reconciliation point for the three provenance surfaces this
   file already flags (G-025's kit stamp, G-117's embedded artifact record, the parked
   RT_VERSION follow-on) - one text record per kit, on every platform.

src/assets/logo/AGENTS.md

@@ -18,11 +18,13 @@ elsewhere in the tree is a derived copy or a build input, never an original.
   `src/vfs/mkzipfix.vfs/` and `src/vfs/punk8_statictwapi.vfs/`. Those four were
   set from `punk-mark.ico` on 2026-07-28 at the user's direction. Propagating a
   later change to them is build machinery owned by G-057 — not a manual step to
-  repeat from here. The `src/runtime/` copy carries an assetorigin sidecar
-  recording the derivation (hash equals source_hash: a byte-identical copy);
-  the three vfs copies stay deliberately unrecorded pending the user call on
-  shipping sidecars inside baked kits (recorded in
-  goals/archive/G-135-asset-provenance-records.md notes).
+  repeat from here. The `src/runtime/` and `_vfscommon.vfs` copies carry
+  assetorigin sidecars recording the derivation (hash equals source_hash: a
+  byte-identical copy); the `_vfscommon.vfs` sidecar ships inside every baked
+  kit that merges the common payload (user-approved 2026-07-28 - inside a kit
+  it truthfully reads source-absent, the icon bytes still hash-confirmed).
+  The `mkzipfix.vfs` and `punk8_statictwapi.vfs` copies stay unrecorded (no
+  decision requested; unrecorded is silent and fully supported).
 
 ## Local Contracts
 

src/vfs/_vfscommon.vfs/punkshell.ico.assetorigin.toml

@@ -0,0 +1,13 @@
+# assetorigin provenance sidecar (schema 1) for the asset named by this file
+# with the .assetorigin.toml suffix stripped. Optional and advisory.
+# punkshell.ico is a byte-identical derived copy of the generated logo artifact
+# (hash equals source_hash). This sidecar ships inside every baked kit that
+# merges _vfscommon.vfs (user-approved 2026-07-28): inside a kit the recorded
+# source is not present, so a checker truthfully reports source-absent there
+# while still confirming the icon bytes match the record; in the punkshell
+# source tree it verifies.
+schema = 1
+role = "pe-resource"
+hash = "sha256:da875dd08a7665162ead7bbb575e2cb8b82a12d6654579c1e389d97198c19a26"
+source = "../../assets/logo/punk-mark.ico"
+source_hash = "sha256:da875dd08a7665162ead7bbb575e2cb8b82a12d6654579c1e389d97198c19a26"