Gate release publication on the exact tested commit

[fettpl]

Summary

• trigger main publication only after the CI workflow completes successfully for a same-repository push to the default branch
• call the reusable full CI workflow for tag and manual releases, then make publication depend only on one aggregate release gate
• bind release context, checkouts, build outputs, artifact names, manifests, and publication to one resolved 40-character commit SHA
• refuse local artifact tampering, immutable R2 checksum/source-manifest drift, and partial immutable release prefixes before upload
• run the complete Python runtime suite with CPython 3.11.15, uv 0.11.33, and a cutoff-locked IPython/MCP dependency set

Behavior and compatibility

This intentionally changes release orchestration: default-branch publication moves from a direct push trigger to trusted workflow_run completion, while tag/manual publication gains a reusable full-CI prerequisite. It does not change the daemon protocol or application APIs.

Verification

• npm run check
• node --test scripts/release-workflow.test.mjs — 19 passed
• exact uv 0.11.33 lock check with --exclude-newer 2026-08-01T14:06:46.468Z — 71 packages resolved, lock current
• complete CPython 3.11.15 runtime suite — 64 passed
• YAML parse and git diff --check
• independent review — clean

Coordination

The Python dependency seam follows #945/#1018 while pinning the #932 uv/Python contract and repository seven-day cutoff. This draft was built from audited revision a18809e0 and will need mechanical reconciliation with the pending workflow changes in #1020, #1022, and #1018 before merge.

No workflow was dispatched, no release artifact was uploaded or published, and no tag or release pointer was created or moved.

Fixes #927

Note

Gate release publication on the exact tested commit SHA

• The release workflow now triggers via workflow_run on successful upstream CI for the default branch, binding all build, CI, artifact, and publish steps to a specific BUILD_SHA instead of a branch ref.
• A new release-context job (resolve-release-context.mjs) validates upstream CI provenance, package version lockstep, trigger type, and tag consistency before any release work begins.
• A new release-gate job (verify-release-gate.mjs) aggregates results from release-context, full-ci, and build, and blocks publication unless the correct CI conditions are met for the trigger type (main/tag/manual).
• Post-pack artifact verification (verify-release-artifacts.mjs) checks SHA256 checksums, manifest provenance (including sourceSha), and optionally compares against immutable remote artifacts before upload.
• The CI workflow (ci.yml) is now reusable via workflow_call with a source_sha input, and gains a new Python runtime test shard using uv.
• Risk: tag and manual releases now run the full CI workflow as a required gate step; previously they published without rerunning CI.

^{Macroscope summarized 259e267.}

[fettpl]

@snimu This is ready for maintainer review. Exact-head CI is fully green, including the new locked Python runtime lane, every Node lane, and the aggregate publication gate. Independent review found no remaining issues. No release workflow was dispatched and no tag, artifact, release, or R2 object was created or changed.