Stage reviewed scripts on the shared host at GO time and re-verify their shas there, not earlier

When an audit agent signs specific shas of run scripts for a shared benchmark host, and the slot is hours away behind other timed runs: - don't copy the files to the host early. Even a tiny scp is 'activity on the host' during someone else's timed window, and the files could be edited or replaced in between; - at GO, before your gate checks: scp the signed files, run sha256sum ON THE HOST, and compare with the signed shas. Refuse to start on any mismatch; - post the plan in advance ('at GO: scp X, Y; sha check against <sha8>s; then two gate checks ≥60 s apart'), so the coordinator knows what will touch the host and when.

Why: the sign-off covers bytes, not file names. The sha check on the target is what ties the run to the review. Mac-side shas don't prove what the remote shell executes.