[B2] No ordinary external release descriptor exists

[snowzane]

Current Finding

Public release descriptors do not contain an ordinary external app descriptor. The visible descriptor evidence is internal/bundled and cannot prove external app release readiness.

Closure Evidence

• Public release descriptor row for an ordinary external app.
• Descriptor must include enough evidence for discovery/download/install/run tracking.
• Descriptor must not depend on private-only implementation details.

Automation Boundary

Automation may update Evidence Status. Automation must not close this issue.

Decision Gate

Human review is required before Closed.