Release and publishing

• R-PUB-01: Publishing happens in CI, triggered by a tag, never from a developer machine · oss-publish
• R-PUB-02: The publish job authenticates to the registry with trusted publishing, not a stored token · oss-publish
• R-PUB-03: Published artifacts carry build provenance · oss-publish
• R-PUB-04: A human approves the run before anything reaches a public registry · oss-publish