Attest releases and prepare v0.3.3

[yeelam-gordon]

Summary

• Generate GitHub artifact attestations for final Core and Semantic archives across the unchanged 11-build release matrix.
• Verify archive bytes against the repository, release workflow, source ref and commit before publishing.
• Scope write permissions to the attestation and release jobs; build jobs remain read-only.
• Add manual workflow dispatch that builds and attests but never publishes a release.
• Document verification and limitations: this is provenance, not Authenticode or notarization; old v0.3.2 assets are not retroactively attested.

Validation

• Mandatory latest-stable core/plugin release clippy checks passed.
• Unit tests: 227 passed, 0 failed, 1 existing ignored.
• Workflow invariants, unchanged build matrix/packaging, bash syntax, and git diff checks passed.
• Full no-publish trial passed: https://github.com/yeelam-gordon/agent-cli-session-TUI/actions/runs/38187298649 . All 11 build jobs and attestation/verification passed; release job was skipped.
• Independently downloaded and verified all 11 archives against source adca144, exact workflow/ref, and GitHub-hosted runner policy. Tampered archive and wrong-source-commit checks both failed as expected.

Release preparation

• Prepare v0.3.3 rather than replace v0.3.2 downloads or move its tag.
• Patch the two blocking root-lockfile advisories: crossbeam-epoch 0.9.20 and rustls 0.23.45. Core and semantic audit scans now have zero blocking vulnerabilities; existing informational warnings remain.
• Re-ran latest-stable core/plugin release clippy and unit tests after the dependency patches: passed (227 tests, 1 existing ignored).
• The production tag will run the full archive build/attest/verify gate again before publishing.

[Copilot]

🔵 Needs a closer look

The security-sensitive release pipeline trial was still in progress during review.

0 open findings

What changed in this PR

Adds GitHub provenance attestations and verification to the release pipeline while preventing manual runs from publishing.

Changes:

• Attests and verifies all release archives before publication.
• Restricts write permissions and adds safe manual dispatch.
• Documents provenance verification and limitations.

File	Description
.github/​workflows/​release.yml	Adds attestation, verification, permissions, and publication guards.
docs/​usage.md	Documents archive provenance verification.
README.md	Links users to provenance instructions.
AGENTS.md	Records release-security invariants.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The workflow permissions, verification gates, manual-run guard, documentation, and successful 11-artifact trial are consistent and complete.

0 open findings

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The workflow safeguards, documentation, version bump, and dependency patches are consistent and validated.

0 open findings

🧠 Review effort: Balanced