fix(release): integrate verified distribution lifecycle

[fettpl]

Fixes #926
Fixes #927
Fixes #934
Fixes #949

Summary

• integrate the branded R2 package channel from fix(packaging): support branded R2 package artifacts #1019, workflow action/permission hardening from Pin workflow actions and minimize release-job secret scope #1020, CI-authoritative release lifecycle from Make CI the authoritative release lifecycle #1022, and exact-SHA Node/Python publication gate from Gate release publication on the exact tested commit #1024
• bind build, verification, workflow artifacts, provenance, and publication to one resolved 40-character source commit
• preserve the existing public channel-manifest shape while adding immutable release-provenance.json metadata and fail-closed local/remote drift checks
• hand publication from the aggregate gate to a non-callable default-branch workflow_run publisher through an exact run-scoped context artifact
• separate GitHub and R2 mutation phases, retain production-environment secret scope, recheck beta freshness before every mutable phase, and authorize rollback before protected resources are acquired
• keep existing release tags retryable with protected current tooling against the exact historical source tree

Release safety

• main publication is admitted only by a successful same-repository CI run on the default branch
• the publisher validates the upstream workflow path, repository, branch, conclusion, event, candidate marker, run ID, tooling SHA, context schema, versions, and channel flags before any protected mutation job
• existing-tag retries require an exact authorized issue comment and reusable full CI at the tagged source SHA
• legacy local npm publication and tag-push commands remain non-mutating tombstones
• no workflow was dispatched and no tag, GitHub Release, R2 object, installer, or channel pointer was published or moved while preparing this PR

Verification

• node --test packages/coding-agent/scripts/check-workflow-security.mjs — 8/8 passed
• npm run release:test — 52/52 passed
• npm run check — passed
• packages/ai/test/cli-branding.test.ts — 2/2 passed
• packages/coding-agent/test/release-package-documentation.test.ts — 5/5 passed
• deterministic CPython 3.11.15 runtime suite — 64/64 passed for current source and pre-migration v0.7.1 source
• changed workflow YAML parsing, changed .mjs syntax checks, and git diff --check — passed
• independent exact-tree release/security review — clean, with no findings

The clean-project branded package contract is wired into CI after the build step, where the required dist trees exist.

Note

Implement CI-authoritative release lifecycle with R2 artifact distribution and rollback support

• Replaces local release scripts with a CI-gated pipeline: build-binaries.yml now triggers on CI completion or authorized retry comments, builds from an exact source SHA using protected tooling, and emits a signed publication context artifact instead of publishing directly.
• Adds a new publish-release.yml workflow that runs after a gated build, validates the publication context, and publishes immutable tarballs to R2 with SHA-256 integrity metadata.
• Adds a rollback-release.yml workflow allowing authorized maintainers to roll back the stable channel via /prime-agent release rollback issue comments.
• Introduces scripts/lib/release-lifecycle.mjs, release-publication.mjs, and release-command.mjs as the core library backing packing, verification, and publication.
• Retires scripts/release.mjs and scripts/sync-versions.js as hard-failing tombstones; local preparation now uses release:prepare, release:dry-run, and release:test.
• Updates all public package READMEs and docs to reference branded package names (prime-agent, prime-agent-ai, etc.) and immutable R2 tarball install paths instead of npm registry installs.
• Risk: any workflow or script that previously invoked the legacy release or sync-versions scripts will now receive a hard error and must be migrated to the new flow.

^{Macroscope summarized d2b2e8e.}

[fettpl]

@snimu This integration PR is ready for maintainer review. It incorporates #1019, #1020, #1022, and #1024 directly, addresses the independent release-security review, and all exact-head Node, Python, and aggregate CI checks pass. No release workflow was dispatched, and no tag, artifact, release, R2 object, or channel pointer was created or changed.