Add CI validation helpers with explicit signature selection and owned results

docs/implementation-status.md

@@ -6,6 +6,13 @@ it should not be read as describing the corrected source unchanged.
 
 ## Implemented with host tests or compilation
 
+- Additive CI result/selection helpers now package native file-object validation,
+  opt-in x64 first-success selection and explicit embedded verification, with
+  shared policy/digest cleanup. Existing APIs retain their behavior. See the
+  [helper contracts](ci-validation-helpers.md). Host failure/forwarding tests and
+  x64/ARM64 builds cover the wrappers; WPP probe v2 consumes them and awaits a
+  returned kernel trace. The previous v1 trace establishes the raw native routes.
+
 - **S01–S04:** subtraction-safe PE ranges, no fixed 4 MiB copy, bounded certificate
   intervals, deterministic failure outputs, and digest cleanup. Compatibility
   and explicit paths share the bounded hashing core.
@@ -95,7 +102,7 @@ and compilation do not close the remaining work:
 
 ## Checks
 
-Run the three host runners in `tests/README.md`. Kernel compilation also covers
+Run the four host runners in `tests/README.md`. Kernel compilation also covers
 the default modern x64/ARM64 structures, the pre-Windows-10 x64 compile variant,
 and 14 assertions in the 26100 opt-in header plus 12 historical-view assertions. Those are build checks,
 not a claim that historical or ARM64 CI runtime ABI has been verified.