docs(audit): Tim's machine IOC resolved — export was user-initiated

packages/opencode/bin/neuron

@@ -18,6 +18,12 @@ case "$ARCH" in
   *) TARGET="" ;;
 esac
 if [ -n "$TARGET" ] && [ -x "$PKG/dist/$TARGET/bin/opencode" ]; then
-  exec "$PKG/dist/$TARGET/bin/opencode" "$@"
+  BIN="$PKG/dist/$TARGET/bin/opencode"
+  # launch-integrity record: every run logs WHO ran and WHAT its fingerprint was
+  LOG_DIR="${XDG_STATE_HOME:-$HOME/.local/state}"
+  SUM=$(shasum -a 256 "$BIN" | cut -d" " -f1)
+  mkdir -p "$LOG_DIR"
+  echo "{\"t\":\"$(date -u +%FT%TZ)\",\"event\":\"launch\",\"bin\":\"$TARGET\",\"sha256\":\"$SUM\"}" >> "$LOG_DIR/neuron-guard.jsonl"
+  exec "$BIN" "$@"
 fi
 exec bun run --conditions=browser "$PKG/src/index.ts" "$@"