[tytremblay]

Summary

source CI → build once → fresh/upgrade smoke tests → publish exact digest
  → verified hawk_suite release proposal → separate production approval

Gate publication on reusable CI. Add per-image configuration validation, deployment metadata, source revision and schema version in health, and disposable-database fresh/upgrade checks. PR CI verifies the linux/amd64 candidate before merge. Main publication opens an immutable release proposal in FRC2713/hawk_suite#16 new pipeline.

Evidence

• Before: publication ran independently of CI and did not hand a release identity to the suite.
• After: 233 application tests pass; typecheck, build and formatting pass.
• Fresh startup and upgrade from the existing published image pass with retained records and SQLite integrity checks. Shell scripts pass shellcheck and workflow syntax passes actionlint.

Merge Danger

Door: two-way

Blast Radius: releases

Merge the suite implementation first. Configure HAWK_SUITE_APP_ID and HAWK_SUITE_APP_PRIVATE_KEY for the suite release App before merging this change. Main still updates compatibility aliases after verification, while production promotion uses the digest and retains its approval gate. No schema migration or production deployment is performed by this PR. See docs/release-pipeline.md and the suite migration guide.