Harden Midtrans CLI for public release review

[salismidtrans]

Summary

• remove internal .superpowers and docs/superpowers artifacts from tracking and future source releases
• pin GitHub Actions and add tidy, vulnerability, secret, workflow, and packaging gates
• make v0.1 GitHub-Release-only, with five platform archives, a source archive, checksums, keyless signing, provenance, and six SPDX SBOMs
• normalize the official Midtrans Markdown delivery preamble, review the remaining source drift, and retry transient documentation transport failures without weakening fail-closed policy
• correct merchant-facing credential and security documentation
• pin the controlled evaluation to Agent Skill integration commit f293153665a9d97b2cb1ab45179b879359370dc2 and run fixture baselines in the release gate

Why

This is the pre-public-release hardening pass for the merchant-facing Midtrans CLI. It closes source-package leakage, supply-chain drift, incomplete packaging verification, brittle official-document checks, and overbroad credential claims found during the audit.

Validation

• ./tools/check_release.sh
• goreleaser release --snapshot --clean --skip=sign with Syft v1.42.3
• ./tools/check_release_artifacts.sh
• Agent Skill compatibility against f293153665a9d97b2cb1ab45179b879359370dc2
• native macOS arm64 version and agent capabilities smoke checks

The package preflight produced five platform archives, one source archive, six nonempty SPDX SBOMs, and a verified checksum manifest. The source archive contains no internal specification paths.

Release gates intentionally still open

• obtain a green GitHub Actions run on the reviewed commit
• run the controlled 18-run Sandbox campaign with at least 17 passes and zero hard failures
• publish and approve the compatible Agent Skill commit
• obtain Security, Product, Support, Release Engineering, and Communications approvals
• record the exact final go/no-go commit before creating any tag

This PR does not create a tag or publish a release.