ci: gate launcher release publication - #1120

What this changes

Release writes use repository-scoped openadapt-release App tokens. The workflow checks the App identity and release controls before it creates a tag, before PyPI receives a file, and before GitHub publishes the release.

The release path also:

• Requires an explicit-published platform selection for all seven public packages. A new launcher candidate can use the reviewed published dependency set, but it can't move behind the published launcher.
• Builds one wheel and one sdist, checks their metadata, and scans every archive member against source-policy.public.json before attestation.
• Rejects unsafe archive paths, links, special entries, duplicate entries, oversized archives, private paths, and private content signatures.
• Checks existing PyPI files byte for byte before skip-existing, then requires the complete immutable two-file release.
• Creates or resumes one GitHub draft without replacing assets. It downloads and checks the artifacts before publication, then verifies GitHub's release and asset attestations.

The package-composition report in docs/published-composition-1.16.0-flow-1.34.0.md records one macOS arm64 run of the published launcher 1.16.0 and Flow 1.34.0 wheels. It binds the source commit, lifecycle script hash, Python 3.12, both wheel hashes, the verified result, and the RECONCILIATION_REQUIRED fault result. Its limits are in the report.

Flow admission gate

The release now stages the exact Flow wheel and sdist selected by the reviewed platform manifest. It accepts only the canonical openadapt-flow PyPI component in explicit-published mode, downloads the exact files.pythonhosted.org files, checks both manifest hashes, and builds the central Flow artifact inventory from those bytes.

Both release runs call the central reusable verifier at exact commit c05ff5c0633e0a1f63d9af74eeb69c31dac3e9ba. The dispatch run verifies Flow before tag creation. The tag-push run verifies Flow again before it builds or publishes the launcher. The verifier checks the registered signed admission, current authority and revocation state, exact Flow repository, tag, source commit, version, and the staged artifact bytes.

Commit c05ff5c0633e0a1f63d9af74eeb69c31dac3e9ba adds inactive qualification issuer workflows. Its production release verifier is unchanged from 989681f6f475616b7e2cb72360c716db0927f7ad.

Hold conditions

The path fails closed today:

• The central evidence registry at c05ff5c0633e0a1f63d9af74eeb69c31dac3e9ba has revision 1, no entries, and no signer registry. Central also has no production release admission issuer workflow.
• The current platform manifest uses latest-published. A release change must commit a reviewed explicit-published selection.
• The launcher version remains 1.16.0, while this branch builds files that differ from the immutable 1.16.0 files already on PyPI. A release needs a new version, changelog entry, lock update, explicit platform selection, and signed admission.
• The openadapt-release App has Contents: write and Metadata: read, but it doesn't have Administration: read.
• Immutable GitHub Releases aren't enabled.
• The repository has no active tag ruleset for refs/tags/v*.
• The release-identity and pypi environments have no protection rules or deployment branch policy.

This PR stays draft while those controls and the exact release admission remain open.

Checks

• Exact base: a1c0b320be1e4d3ee50417e4732cd43504d691fa
• Exact head: 9496ac97e9735a6d1904233041b37542973db9ce
• Full suite: 264 passed, 6 skipped
• Ruff and changed-file formatting passed
• actionlint, release lock, source-boundary, and diff checks passed
• Offline platform validation passed with zero warnings
• Wheel SHA-256: fe1cf559e30ee966fcd99b5ff1c11b767a67faf56179516bbae87de7033bd7a5
• Sdist SHA-256: 25f2ed8962939f2a0d5fe9aaea4d3e4f3ad5d0153185c2ca6b3ec89f01c2d989
• The current latest-published manifest failed the new release selector as required

Known follow-ups

• Bind an existing recovery draft's title and notes to the release changelog.
• Verify PyPI PEP 740 provenance in addition to the public file bytes.