chore: Add verified Mail backend rebuilds and maintenance policy

[nerdislb]

Summary

Add a backend-only nbshell maintenance release for the bundled Mail source, with a distinct version, native Linux builds, source/build provenance, public-asset verification and archive hashes anchored in the shell source. Keep UI, bar, accounts and configuration unchanged.

The bundled source already implements API 5; the previous upstream runtime pin provides API 4. This release does not introduce a new API implementation. Its additional dependency fix is Rustls 0.23.45 for RUSTSEC-2026-0285.

Release Notes

• Prepare a security-maintained Mail backend with verified Linux x86_64 and ARM64 packages.
• Reject changed backend archives even when their remote checksum is changed with them; preserve the previous runtime on failure.
• Document the maintenance cadence, ownership, update/rollback gates and criteria for returning to upstream.

Verification and current state

• 41 runtime-manager tests and 27 packaging/version/API/provenance tests pass locally.
• The existing real package/installer contract, plugin validation, release privacy audit and strict manual build pass.
• The shell updater ignores backend-only release tags.
• Both native static builds and both public-download API/real-installer jobs passed: https://github.com/nerdislb/nbshell/actions/runs/35186621837 .
• Published backend: https://github.com/nerdislb/nbshell/releases/tag/mail-backend-0.10.4-nbshell.1 . Only after verification, the pin advanced to that exact version, both archive hashes were anchored in backend-release.json, and the already-implemented API 5 was marked released.
• The actual downloaded x86_64 executable passed the production Quickshell process bridge and 22 native-agent tests locally. The legacy-adoption case used its supported historical runtime/bin layout; the installed-plugin upgrade guard remains in place.
• The full local release gate passed, including fresh installation/rollback. The new backend and shell are installed; pinned metadata and binary bytes match, both configuration hashes are unchanged, and there are no new QML/runtime errors.
• The full push gate on 484f6ce passed; its parallel PR run exposed a pre-existing fixed-delay QML timer race. The fixture now waits for the actual toast transition, then checks persistence of the recovery warning. Five focused repetitions and all 76 component tests pass; production UI/timer behavior is unchanged.
• Shell release-note generation now explicitly selects the preceding shell tag, excluding backend-only releases. A real mixed-tag Git fixture confirms selection of Beta 12 rather than the intervening backend release.
• Final push/PR validation on b802db9 is running. Merge waits for those jobs. Beta 13 tagging and signed-shell-archive verification follow separately.
• Independent provider review was attempted: Claude Fable quota exhausted, Sonnet timed out without a result, Gemini Pro returned empty output. None is counted as a completed review. No paid fallback was enabled.

Maintenance scope

Use standard Linux runners in this public repository, one-day artifact retention and no uploaded Rust cache. No scheduled monitoring, automatic dependency merging, paid capacity or account changes are enabled. Existing release assets remain immutable.