security(quasar): CI guard vs trusted-dealer keygen + drop stale v0.1 pulsar comment

Add scripts/no-trusted-dealer-guard.sh: greps non-test .go in the consensus
tree for NewTrustedDealer / func GenerateKeys / GenerateDualKeys /
GenerateThresholdKeys / GenerateDualThresholdKeys and exits non-zero if any
land in production code. Wired as a prerequisite of `make test` and
`make security` so the regression that dropped the test-only relocation
(97b2dfe7c) on a merge cannot silently return.

Also delete the stale polaris.go comment "Produced by the
pulsar.ThresholdSigner ceremony" — that v0.1 reconstruct-then-sign Combine
path was ripped; the leg is filled by the corrected lattice kernel.

Makefile

@@ -29,7 +29,7 @@ build: ## Build all tools and commands
 # === TEST TARGETS ===
 
 # Run all tests
-test: ## Run all tests
+test: guard-no-trusted-dealer ## Run all tests
 	@echo "🧪 Running tests..."
 	@go test -race -timeout 5m -tags="!integration" ./... 2>&1 | grep -v "warning.*LD_DYSYMTAB" | grep -v "has malformed LC_DYSYMTAB"
 
@@ -222,8 +222,13 @@ static-analysis: ## Run static analysis
 	@go vet ./...
 	@staticcheck ./... 2>/dev/null || echo "⚠️  staticcheck not found, skipping"
 
+# Guard: no trusted-dealer keygen in production (non-test) code
+guard-no-trusted-dealer: ## Fail if trusted-dealer keygen helpers exist in non-test code
+	@echo "🔒 Guard: no trusted-dealer keygen in non-test code..."
+	@bash scripts/no-trusted-dealer-guard.sh
+
 # Check for security vulnerabilities
-security: ## Check for security vulnerabilities
+security: guard-no-trusted-dealer ## Check for security vulnerabilities
 	@echo "🔒 Checking for vulnerabilities..."
 	@govulncheck ./... 2>/dev/null || echo "⚠️  govulncheck not found, install with: go install golang.org/x/vuln/cmd/govulncheck@latest"
 

protocol/quasar/polaris.go

@@ -59,7 +59,6 @@ type PolarisLegs struct {
 	BLS *bls.Signature
 
 	// Pulsar is the Module-LWE threshold signature for the round.
-	// Produced by the pulsar.ThresholdSigner ceremony.
 	Pulsar *pulsar.Signature
 
 	// Corona is the Ring-LWE threshold signature for the round.

scripts/no-trusted-dealer-guard.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# no-trusted-dealer-guard.sh — CI guard: no trusted-dealer keygen in production code.
+#
+# Trusted-dealer keygen helpers (NewTrustedDealer / GenerateDualKeys /
+# GenerateThresholdKeys / GenerateDualThresholdKeys / a `func GenerateKeys`) mint
+# EVERY threshold share inside ONE process — a single point of full-key compromise.
+# Production chain genesis MUST key off the dealerless Pedersen DKG
+# (keyera.Bootstrap, EpochManager.InitializeEpoch). Those helpers were relocated to
+# protocol/quasar/keygen_testsupport_test.go (TEST ONLY). This guard fails the build
+# if any of them reappear in NON-TEST consensus code, so the regression that dropped
+# the relocation (97b2dfe7c) on a merge cannot silently return.
+#
+#   exit 0 = clean   exit 1 = trusted-dealer keygen found in non-test code
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# Bare helper names are never legitimate in non-test consensus code. `GenerateKeys`
+# is matched only as a *definition* (`func GenerateKeys`) so the legitimate library
+# call coronaThreshold.GenerateKeys(...) — which lives only in the test fixture — is
+# never flagged.
+patterns='NewTrustedDealer|func[[:space:]]+GenerateKeys|GenerateDualKeys|GenerateThresholdKeys|GenerateDualThresholdKeys'
+
+# Scan every .go file under the consensus tree, excluding *_test.go. Filter on the
+# filename field (awk $1) so a comment merely mentioning a *_test.go path can never
+# mask a real hit.
+hits="$(grep -rnE --include='*.go' "$patterns" "$repo_root" 2>/dev/null \
+        | awk -F: '$1 !~ /_test\.go$/' || true)"
+
+if [[ -n "$hits" ]]; then
+  echo "FAIL: trusted-dealer keygen found in NON-TEST consensus code:" >&2
+  echo "$hits" >&2
+  echo >&2
+  echo "Relocate these helpers into a *_test.go (see protocol/quasar/keygen_testsupport_test.go)." >&2
+  echo "Production genesis keying must use the dealerless Pedersen DKG (keyera.Bootstrap)." >&2
+  exit 1
+fi
+
+echo "OK: no trusted-dealer keygen in non-test consensus code (protocol/quasar + tree clean)."