Retained financial join audit

Run in the investigation workspace:
python3 evidence/attacker-correlation-20261031T1926/joins/audit_retained_joins.py

The script reads only the exact retained public-financial inputs listed in SOURCE-PROVENANCE.json and uses the pinned earlier standard-library signature verifier. It reconstructs all77 transaction hashes/recovered signers and runs valid changed-value controls. It compares selected verified Car financial keys, separately verified market counterparties, June keys/addresses and the new discovery addresses. It checks exact24 signed bridge trailers against four selected Car bridge/funding records. No new source history or network call is made.

These curated results are not a standalone portable replay: their raw financial inputs and verifier dependencies are the separately retained, hash-pinned evidence files. The script rewrites only this joins output directory. Replaying after the output freeze creates a new timestamped result; preserve the selected version if reproducing separately. No private identity or common-control claim is inferred from services or token-log lookalikes.
