feat(release): automate verified pre-tag candidate promotion

[jeremi]

Summary

Implements the automation and evidence model from #484 across all five workstreams:

• upgrades both product advisory baselines to schema v2 with enforced component, runtime-base, and image-evaluated exposure bindings
• adds a trusted pre-tag candidate workflow with two isolated native-Linux builds, exact binary and OCI config/layer comparison, immutable-digest scans, a closed receipt, and isolated build attestations
• converts tag releases into exact candidate promotion with run/attempt/tag binding, no product rebuild, no public write before verification, digest-preserving image copy, signatures, tag-bound SLSA provenance, and final reconciliation
• adds automatic standard/extended proof selection, scheduled clean repeatability proof, seven-day candidate cleanup, storage preflight and telemetry, and operator procedures
• records current OpenSSF Silver evidence in-tree and adds CI classification, Actionlint, advisory-copy parity, and 160 fail-closed release-security gates

Definition of done

• Every locally implementable workstream 1 through 5 code path, test, workflow, and public/operator documentation change is present
• Promotion is bound to one protected-main source commit, candidate run, run attempt, release identity, and annotated-tag receipt digest
• No public GHCR or GitHub Release write is reachable before candidate comparison, immutable-digest scans, receipt/attestation verification, tag binding, replay checks, and destination absence checks pass
• Candidate binaries are never executed by promotion, promotion never rebuilds product binaries or images, and public image digests must exactly equal private staging digests
• Candidate verification is read-only; OIDC and publication permissions are isolated into later jobs with prior verified, hash-bound inputs
• Final SLSA subjects, release assets, hashes, image topology, signatures, and candidate receipt are reconciled exactly
• Candidate artifacts and staging images have bounded seven-day retention with a closed cleanup allowlist
• Storage enforcement remains fail-closed in measurement_required state until a real hosted run supplies a measured numeric budget
• OpenSSF evidence, external verification commands, repeatability scope, telemetry, and operator failure states are documented truthfully
• Architecture/security review and an independent final diff review completed; the discovered in-progress run-conclusion blocker was fixed and independently rechecked
• Seven area-scoped commits are DCO signed and based on the current origin/main

Security decisions and deviation

Privileged manual operations use repository_dispatch, so package-write and OIDC workflow code always comes from the protected default branch. Automation never creates or updates Git refs, and gh release create --verify-tag prevents implicit tag recreation if a verified tag disappears.

The issue expected the three existing libc6 dispositions to use dynamic_symbol_absent. Real v0.13 service ELF evidence shows the binaries import dlsym, and CVE-2026-5450 is callsite-specific rather than expressible as simple symbol absence. Treating symbol absence as evaluable would be fail-open. The implementation therefore uses the issue's allowed file_digest_equals assertion over the complete executable closures, plus the specifically reviewed out-of-closure libraries. This is stricter, forces re-review when those reviewed bytes change, and is documented in the baselines. The independent security review found the deviation defensible and fail-closed.

Verification

• actionlint .github/workflows/*.yml
• release gate inventory: 160 gates passed, with 64 gate-inventory regression tests
• focused Python suites: 223 tests passed
• advisory v2 and checker-copy suites: 59 tests passed
• docs suites: 119 tests passed
• npm run check: current and archived docsets built; 586,127 internal links/assets checked
• ruff check, ruff format --check, Python compileall, YAML duplicate-key validation, and git diff --check
• REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
• release/scripts/registry-release validate release/manifests/registry-stack-beta-17.yaml
• crates/registry-relay: just ci-preflight
• products/notary: just ci-preflight

Live acceptance blockers before this can leave draft

• Pre-provision registry-notary-candidate and registry-relay-candidate as private GHCR packages and verify live package visibility
• Run the first instrumented hosted candidate and replace measurement_required with the measured per-runner storage budget
• Exercise the live tamper drill and one complete candidate-to-beta promotion against GitHub Actions/GHCR
• Run the first post-merge extended repeatability proof against a published tag and refresh the durable Prove bit-for-bit repeatable release builds #127 evidence

These require merged default-branch workflow code, live GitHub Actions/GHCR state, and a real published tag. They are intentionally not represented by fabricated local evidence.

Refs #484