release: make the OSS repository and runtime image public

[bradtaylorsf]

Summary

Publish the audited OSS repository and GHCR runtime image after policy, history, workflow, and GitHub hardening prerequisites pass.

Proposed Approach

• Confirm history/identity approval and clean security audit.
• Confirm branch and Actions hardening.
• Change repository visibility to public.
• Change the GHCR runtime package to public through GitHub's supported administrative surface.
• Verify anonymous source access and digest-pinned image pulls.

Acceptance Criteria

• Policy, history, workflow, and settings prerequisites are complete.
• Repository is publicly browsable and anonymously cloneable.
• Runtime package is anonymously pullable by immutable digest.
• No private dependency blocks a fresh user.
• Publication state is re-read anonymously and recorded.
• Incident and disclosure instructions are visible.

Related

• Parent epic: epic: deliver zero-to-first-memory desktop onboarding and isolated local channels #40
• Blocks installer publication and clean-machine acceptance.
• Do not publish npm.

[bradtaylorsf]

Publication progress on 2026-08-19 UTC:

• Repository is public and anonymously readable/cloneable at https://github.com/the-answerai/answer-engine.
• Anonymous API re-read reports visibility=public, private=false, and Apache-2.0 licensing.
• master protections and public-contribution hardening are complete in security: harden GitHub settings for public contributions #79.
• Immutable tag v1.1.1 resolves to source commit a346a8c6a7833596c088ccdebadd69e3608c386b.
• Runtime workflow 32211079812 passed AMD64 and ARM64 builds plus zero-fixable-high/critical Trivy gates, then published ghcr.io/the-answerai/answer-engine@sha256:418c93dac3753e0850f5ba6627581f888acdd65f3b91b655bd898cee56f10701.
• GHCR remains private pending the supported package-settings UI handoff. The workflow intentionally has no visibility-mutation permission.

Keep this issue open until the exact digest is anonymously inspectable/pullable and the state is recorded.

[bradtaylorsf]

The v1.1.2 multi-architecture runtime is now published at the immutable digest sha256:56ebd5921ed3db87e1f6ffa49593c0b8577d21197b5798c1fb72b275ddae0fd9 by successful workflow run https://github.com/the-answerai/answer-engine/actions/runs/32520170568.

GHCR package visibility is still private. Anonymous inspection returned 401 Unauthorized in installer candidate run https://github.com/the-answerai/answer-engine/actions/runs/32521393503, so this issue remains open until the package is changed to Public in GitHub's package settings UI and the exact digest is verified without credentials.