docs: self-contained reproduction — vendor frozen prereg + bibliography, add REPRODUCE.md

Make a clean clone reproducible without a sci-method checkout:
- vendor the frozen pre-registration (docs/prereg/, pinned SHA-256 f22331a7… unchanged)
  and the 36-source bibliography into the repo
- confirmatory_run.py resolves the in-repo prereg first, falling back to the canonical
  sci-method path; the SHA gate is identical (the pin, not the path, is the guarantee)
- add REPRODUCE.md: tiered clone→env→seed→run→analyze checklist, honest about the
  isolated-engine containment rule and the 1.2 GB raw data that is not committed

Defensive-measurement instrument; no change to measured behavior.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd_chat/sor/confirmatory_run.py

@@ -45,8 +45,14 @@ from cmd_chat.sor.forwarder import assert_isolated
 
 # The frozen prereg (read-only source of truth) and its pinned SHA-256. A GO is
 # refused unless the on-disk prereg still hashes to this — no confirmatory run
-# against an unfrozen/edited prereg.
-FROZEN_PREREG = Path.home() / "coding/sci-method/stages/03-design/output/sor-consent-prereg.md"
+# against an unfrozen/edited prereg. Two locations are accepted, in order: the
+# in-repo vendored copy (so external reproducers have a self-contained artifact)
+# and the operator's canonical sci-method checkout. The SHA-256 gate is identical
+# for both — the pin, not the path, is the integrity guarantee.
+_REPO_ROOT = Path(__file__).resolve().parents[2]
+VENDORED_PREREG = _REPO_ROOT / "docs/prereg/sor-consent-prereg.md"
+CANONICAL_PREREG = Path.home() / "coding/sci-method/stages/03-design/output/sor-consent-prereg.md"
+FROZEN_PREREG_CANDIDATES = (VENDORED_PREREG, CANONICAL_PREREG)
 FROZEN_PREREG_SHA256 = "f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b"
 
 OPERATOR_TOKEN_ENV = "SOR_CONFIRMATORY_GO"
@@ -57,12 +63,16 @@ def _ts() -> str:
 
 
 def verify_freeze() -> bool:
-    """True iff the on-disk frozen prereg still matches its pinned SHA-256."""
-    try:
-        got = hashlib.sha256(FROZEN_PREREG.read_bytes()).hexdigest()
-    except OSError:
-        return False
-    return got == FROZEN_PREREG_SHA256
+    """True iff a frozen prereg is present (vendored or canonical) and its bytes
+    still hash to the pinned SHA-256."""
+    for path in FROZEN_PREREG_CANDIDATES:
+        try:
+            got = hashlib.sha256(path.read_bytes()).hexdigest()
+        except OSError:
+            continue
+        if got == FROZEN_PREREG_SHA256:
+            return True
+    return False
 
 
 def preflight(out_dir: Path, *, order_seed: int = battery.S0, allow_live_gate: bool = True) -> Dict[str, Any]: