git show origin/master:evals/brainbench/baselines/main.json is the compare
target, so a PR cannot rewrite the thing it's graded by (plan decision 4).
Hermetic, zero keys, ~15s. ci-brainbench-gate.sh is local parity (with an
ungated first-landing path); render-brainbench-delta.ts emits the step-summary
/ PR-body delta block from the --out artifact.
