feat(release): bind publication to immutable RC

[0xLeif]

Summary

• make Ubuntu the ordinary development integration platform
• freeze each release candidate with an immutable annotated RC tag bound to one SHA
• run the same Fledge release-candidate lane on Ubuntu, macOS, and Windows
• fail closed unless SHA-bound platform evidence is green before final tag creation and upload
• validate protected tag rulesets and the release environment before promotion

Verification

• 2,178 unit tests passed
• 333 integration tests passed
• release-candidate validator and adversarial tests passed
• workflow pin validation and lifecycle assertions passed
• independent scoped review passed

Dependency

• stacked on chore(ci): remove duplicate Trust test suite #491 so this PR remains thin; retarget to main after chore(ci): remove duplicate Trust test suite #491 merges

Activation prerequisite

• provision the dedicated release GitHub App and production rulesets/environment documented in the change package before the first RC promotion

[github-actions]

✅ Corvin says...

      _
    <(^\  .oO(Caw! ^v^)
     |/(\
      \(\\
      " "\\

"Looking sharp! Like a beak should be."

CI Summary

Check	Status
Validate action.yml	✅ Passed
Packaged Action Consumer	✅ Passed
Dependency Audit	✅ Passed
Code Coverage	✅ Passed
Format Check	✅ Passed
Docs Site	✅ Passed
Spec Validation	✅ Passed
Tests (build, test, clippy)	✅ Passed
VS Code Extension	✅ Passed

📋 Spec Validation Details

✅ SpecSync: Passed

Metric	Value
Specs checked	62
Passed	62
Errors	0
Warnings	0
File coverage	100% (105/105)
LOC coverage	100% (124864/124864)

---

Generated by specsync · Run specsync check --format github to reproduce

---

_{Powered by corvid-pet}