[tulik]

Temporary mitigation for protected gov.txt.gz failure

On October 22, 2026, gov.txt.gz failed strict preflight parsing with reason=record_fields. This PR temporarily excludes only exact gov, without claiming the source is valid or relaxing record parsing.

Behavior

• A shared select_zone_inputs() applies --exclude-zone gov in both preflight and aggregation. It checks every manifest file, requires a matching .gov manifest entry and at least one included file, rejects all other exclusions, and leaves the persistent download set intact.
• The workflow uses the same fixed NSDB_TEMP_EXCLUDE_ZONE=gov for both stages. Other TLDs remain mandatory.
• Private counts and coverage, plus public snapshot, coverage, diff headers, public counts, change counts, release title and release notes explicitly label coverage_complete=false and excluded_zones=gov.
• Partial comparisons are flagged with comparison_break=true; restoring .gov changes coverage and is marked coverage_changed=true.
• Synthetic regression tests cover exact match, no exclusion by default, failure when gov is absent or the only zone, inability to bypass other bad zones, manifest immutability, partial publication, restoration and metadata inconsistency.
• process_input(), SOA consistency, DNS ordering, delegation deduplication and public threshold semantics remain unchanged; checkpoint issue Resume CZDS aggregation from verified per-zone checkpoints #6 remains independent.

Caveats

This is not an input-format correction or proof that every other CZDS input passes. All public data represents only the included approved CZDS subset. Do not remove the exclusion until protected-runner validation succeeds and the source defect has a synthetic reproducer.

Follow-up: #11 (restore gov), #6 (checkpoints). CI and protected preflight must pass before publication.