The authorized-software list is a run profile

The agency's authorized-software list is a spreadsheet nobody reads until the audit. On the containers it is a run profile.

Profile authorized: sources_mode allowlist, one source (the agency's pinned nix flake), policy require_verified true, deny_providers oci and appimage. A clerk, a script, or an agent asks the resolver: GET /api/v1/run/resolve?app=libreoffice&profile=authorized&pick=first. Back comes one exact shell command from the one permitted source, and the terminal runs it. Sources outside the allowlist were never searched, so nothing from them can become a candidate. A pick against a stale candidate set that policy now forbids returns POLICY_DENIED.

The resolver never executes anything; it answers with a command. Update the flake, sync the source, and every container's answer changes with it.

The install policy is a profile the resolver enforces, not a memo the user remembers.