v0.31.1 was yanked from crates.io because `cargo install aprender@0.31.1`
panicked at aprender-mcp build.rs — `CARGO_MANIFEST_DIR/../../contracts/
apr-mcp-tool-schemas-v1.yaml` lives in the monorepo tree but NOT in the
published tarball (outside the package root), so every external install
hit a hard panic at build time.

Three-layer defense so this class never recurs:

1. **In-crate contract copy** — contracts/apr-mcp-tool-schemas-v1.yaml
   copied into crates/aprender-mcp/contracts/ and Cargo.toml `include`
   lists `contracts/*.yaml`. build.rs reads `CARGO_MANIFEST_DIR/
   contracts/…` (no `..` escape). Drift-guarded by new test
   `contract_copy_matches_workspace_root` which asserts byte-identity
   with the workspace-root copy in-tree, and skips when the workspace
   copy is absent (published-tarball mode).

2. **Static Poka-Yoke** — scripts/check_build_rs_paths.sh walks every
   git-tracked build.rs, flags any that join `".."` onto
   CARGO_MANIFEST_DIR AND `panic!`/`unwrap_or_else(…panic)` AND lack a
   `.exists()` guard or `ALLOW_ESCAPE` annotation. Reverting this fix
   locally makes the gate exit 1 with a remediation message.

3. **Wired into both gates** — `make tier3` runs the check pre-push,
   and `.github/workflows/ci.yml` `workspace-test` job runs it on every
   PR so a future build.rs path escape can't sneak back in.

Yank command (already executed):
  cargo yank --version 0.31.1 <each of 68 crates>  # all confirmed yanked

Next step after this lands: cut v0.31.2, re-publish all 68 crates at
40s/crate pacing (crates.io 30-per-10min window), verify `cargo install
aprender --version 0.31.2` actually installs this time.

Refs: task #64 (yank), #65 (fix), #66 (prevention)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>