Adoption on-ramp: prebuilt-binary release + rosalind-budget GitHub Action

[logannye]

Summary

Turns the differentiator from "clone → fight the htslib C-toolchain build" into "run the memory contract in 60 seconds," and gives builders a drop-in way to enforce the contract in their own CI. From the audit: the live plan → enforce → verify loop is a 60-second demo, but it was unrunnable by strangers (no releases/tags/containers).

• release.yml — on a v* tag (or workflow_dispatch dry run): builds a static x86_64-unknown-linux-musl binary + native macOS arm64/x86_64, bundles each with the illumina_toy contract-demo fixtures + licenses into a tarball (+ sha256), and attaches to the GitHub Release.
• install.sh — curl … | sh: detects OS/arch, downloads the matching tarball (gh for private, curl fallback), unpacks, and prints the bundled plan → enforce → verify demo. Detection + error paths verified locally.
• README "Quickstart (60 seconds)" — curl-install then the exact contract commands (re-verified end-to-end on the release binary: [FITS] → contract: OK → verify: OK).
• rosalind-budget composite Action (action.yml) — - uses: logannye/rosalind-budget@v1 downloads the prebuilt binary, runs plan + variants --index --enforce (fails the consumer's build on exit 3 refuse / exit 4 breach), uploads the BLAKE3 receipt. Safe env-var input pattern; an optional binary-path skips the download. cli-e2e exercises the Action live via uses: ./ with the from-source binary, so action.yml is tested in CI today — before any release exists.

Spec: docs/superpowers/specs/2026-06-02-adoption-on-ramp-design.md.

Honest notes

• CI-only verification: the Linux musl-static build and the release publish run on GitHub runners — not run-verifiable locally. This PR delivers reviewed infrastructure + a locally-verified macOS quickstart + a CI self-test of the Action.
• The v0.1.0 tag is the trigger: merging this releases nothing; release.yml fires on a tag push. Cutting the tag stays a deliberate, separate step.
• Container deferred (a second channel for the same binary) — a clean follow-up.

Test plan

• cargo test green; cargo fmt --all -- --check clean; 0 warnings (debug + release)
• All 3 workflow/action YAML files structurally valid
• Quickstart commands re-verified on the release binary (FITS / contract OK / verify OK)
• Linux musl-static build + release publish — validated when CI/the tag first runs

🤖 Generated with Claude Code