release: bootstrap inert release control plane

[ntanwir10]

Purpose

Bootstrap the reviewed release control plane onto main while every publication authority remains inert. This makes the default-branch workflows available for later provider onboarding and rehearsals without changing the public product version or starting a release.

Provenance and scope

• Base truth: ae98219e10d0f0bf9118c0ed00b024f429fea3e7 (main)
• Reviewed release truth: eb3adbe99b62614b000cb17e7802c11331afc3d0
• The provenance contract binds 54 imported files byte-for-byte to that reviewed release SHA.
• The bootstrap diff allowlist permits only release workflows, schemas/tooling, neutral ledger/catalog seeds, release documentation/configuration, the CI inertness gate, and the neutral Release Please manifest.
• cli/package.json and cli/package-lock.json remain at public version 1.0.5.
• .release-please-manifest.json is neutral at 1.0.5; Release Please is separately gated by RELEASE_PLEASE_ENABLED.

Safety changes

• Removes the legacy CI v* tag trigger and its direct npm/GitHub publishers.
• Installs the hardened, SHA-pinned release workflows behind explicit disabled authority checks.
• Adds deterministic draft-release checkpointing so retries rehydrate verified bytes instead of rebuilding signed artifacts.
• Places TestPyPI and PyPI jobs directly in the caller workflow with distinct environments and OIDC permissions.
• Adds an exact-head, non-publishing Apple/Azure provider rehearsal path.
• Uses least-privilege credential-health tokens, the documented WinGet token environment, and a real Chocolatey upgrade rehearsal.
• Seeds only the neutral release ledger and empty shared-catalog contract.

Current closed posture

• Repository RELEASE_AUTOMATION_ENABLED=false was rechecked before push.
• RELEASE_PLEASE_ENABLED and RELEASE_PROVIDER_REHEARSAL_ENABLED are absent, which is fail-closed for their == 'true' guards.
• The protected release-ledger branch contains only active-versions.json with an empty trains array.
• The newest public GitHub release remains v1.0.5.
• This PR creates no tag, release, registry publication, catalog update, or ledger event.

Verification

• Hardened source SHA: complete hosted CI and aggregate Release gate passed on Linux, macOS, and Windows, including SEA, package, and package-manager matrices.
• Bootstrap contract: 8/8 assertions pass for provenance, scoped diff, version neutrality, disabled publication, workflow YAML/dependency graphs, action pinning, ledger seed, rollback bootstrap, checkpoint retry, and PyPI topology.
• 1.0.5 application typecheck and build pass locally.
• git diff --check passes.

Review checklist

• Confirm the imported control-plane digest and exact source SHA.
• Confirm 1.0.5 is unchanged in package metadata and the Release Please manifest.
• Confirm every mutating workflow job is gated and the provider rehearsal cannot publish.
• Confirm CI has no tag trigger or direct publisher.
• Confirm the ledger seed is empty and rollback bootstrap remains fail-closed.
• Require hosted CI on this exact PR head before approving or merging.

Do not merge this PR until its exact head is green and the bootstrap review is complete. Merging this PR is not authority to enable automation, configure providers, mark PR #32 ready, create a candidate tag, or publish anything.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d2ecfb6c-1245-4c0d-bb2d-4f79593a159f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}