ci: publish v0.1.0 artifacts through GitLab and OSS

[salismidtrans]

Summary

• add a tag-gated Goto GitLab pipeline that validates refs, runs the release checks, packages with pinned GoReleaser and Syft versions, publishes manually through the established Alicloud OIDC flow, and verifies every public download
• add a deterministic release manifest that allowlists artifacts, records SHA-256 hashes, and binds URLs to the immutable tag and pipeline path
• remove the obsolete GitHub Actions tag publisher and Cosign configuration for v0.1.0
• document GitHub Releases as the metadata page and Alicloud OSS as the artifact host, with v0.1.0 explicitly checksummed but unsigned
• keep .superpowers, docs/superpowers, and local worktrees ignored and untracked

Why

GitHub Actions is currently unavailable because of the repository billing state. GitHub remains the canonical source repository, while Goto GitLab is used only as the release builder and Alicloud OSS publisher. Operators continue to push the approved commit and annotated tag manually.

Validation

• ./tools/check_release.sh
• go install github.com/anchore/syft/cmd/[email protected]
• go run github.com/goreleaser/goreleaser/[email protected] release --snapshot --clean
• ./tools/check_release_artifacts.sh
• GitLab CI lint API: valid with no errors or warnings
• generated and verified five platform archives, one source archive, six SPDX SBOMs, and the checksum manifest
• configured and read back the GitLab v* protected-tag rule with Maintainer-only creation
• confirmed no tracked internal specification paths and no release tag at HEAD

Remaining release gates

• manually push the approved main commit to the currently empty Goto GitLab repository
• confirm inherited Alicloud production variables and configure protected OSS_PUBLIC_BASE_URL
• require a green GitLab main snapshot pipeline before creating an annotated release tag
• complete the controlled 18-run evaluation, Agent Skill coordination, stakeholder approvals, tag pipeline, OSS publication, and clean-environment download verification

No Git tag, OSS object, or GitHub Release was created by this change.