Fix: Harden pinned runtime activation

setup/provenance/README.md

@@ -64,6 +64,14 @@ Artifact digests were checked with `sha256sum ARTIFACT` against the lowercase
 64-hex values in `installers.conf`; all runtime downloads also enforce the
 recorded byte limit before atomic replacement.
 
+The `*_BINARY_SHA256` values are the SHA-256 digests of the exact executable
+bytes selected from each verified runtime archive. They were derived without
+executing the artifacts: `tar -xO` selected Node's `bin/node` and Codex's
+`bin/codex`, while `unzip -p` selected Bun's `bun`. Runtime version directories
+record both the reviewed archive digest and this reviewed installed-byte digest
+in `.panama-provenance`; later runs require the receipt and re-hash the installed
+binary before treating an existing directory as trusted.
+
 ## Rotation policy
 
 Do not replace a key on an automated update. A key rotation is a reviewed