feat(workout): gate mobile verification on product tests

Make workout mobile-verify rerun the Workout product tests before release-kit checks so app value, recovery, local state, and host capability boundaries fail closed with mobile artifacts.

req: examples/001

req: examples/006

req: host/002

req: local/001

docs/recipes/mobile-release.md

@@ -29,11 +29,13 @@ target/hemx-mobile/workout/
   ios/README.md
 ```
 
-Use `workout mobile-verify` to check the generated kit and release binary. It
-fails on a non-HTTPS production origin, missing/inconsistent Android or iOS
-metadata, or external toolchain/signing blockers that were not written into the
-manifest and `BLOCKERS.md`. Use `workout doctor` when you only want to see
-missing external inputs.
+Use `workout mobile-verify` as the store-readiness product gate: it runs the
+Workout product tests, then checks the generated kit and release binary. It
+fails on broken app value/recovery/host-boundary tests, a non-HTTPS production
+origin, missing/inconsistent Android or iOS metadata, or external
+toolchain/signing blockers that were not written into the manifest and
+`BLOCKERS.md`. Use `workout doctor` when you only want to see missing external
+inputs.
 
 ## Production configuration
 

examples/workout/README.md

@@ -70,11 +70,14 @@ HEMX_WORKOUT_ORIGIN=https://workout.example.com \
 ```
 
 The kit lands in `target/hemx-mobile/workout` unless
-`HEMX_WORKOUT_MOBILE_OUT` is set. It records app identity, version, production
-origin, runtime asset policy, cache/offline state policy, secrets/signing
-boundaries, rollback expectations, Android TWA metadata, iOS WebView metadata,
-and any external blocker such as missing Android SDK, Xcode, or store signing
-credentials. See `docs/recipes/mobile-release.md`. req: examples/006
+`HEMX_WORKOUT_MOBILE_OUT` is set. `workout mobile-verify` reruns the Workout
+product tests before checking the release kit, so app value, recovery, local
+state, and host capability boundaries fail closed with the mobile artifacts. The
+kit records app identity, version, production origin, runtime asset policy,
+cache/offline state policy, secrets/signing boundaries, rollback expectations,
+Android TWA metadata, iOS WebView metadata, and any external blocker such as
+missing Android SDK, Xcode, or store signing credentials. See
+`docs/recipes/mobile-release.md`. req: examples/006
 
 ## Boundaries proven
 

hemx-xtask/src/main.rs

@@ -127,7 +127,18 @@ fn run_workout_mobile_release() -> ExitCode {
 }
 
 fn run_workout_mobile_verify() -> ExitCode {
-    // req: examples/006
+    // req: examples/001 req: examples/006 req: host/002 req: local/001
+    let budget = Budget::detect();
+    budget.report();
+    if let Err(code) = Step::new(
+        "workout-mobile-product-gate",
+        ["test", "-p", "hemx-workout-example"],
+    )
+    .run(&budget)
+    {
+        return code;
+    }
+
     let config = WorkoutMobileConfig::from_env();
     let failures = verify_workout_mobile_release(&config, true);
     let blockers = mobile_external_blockers(&config);