test: #42 외부 consumer 검증 게이트 추가

.github/workflows/release-candidate.yml

@@ -0,0 +1,45 @@
+name: Token Pilot Release Candidate Verification
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify 0.1.0 external consumers
+    runs-on: ubuntu-latest
+    environment: release
+    env:
+      SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+      SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Java 25
+        uses: actions/setup-java@v5
+        with:
+          java-version: '25'
+          distribution: zulu
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v3
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+
+      - name: Build and verify the signed release candidate
+        run: ./gradlew build verifyReleaseCandidate verifyExternalConsumers -PprojectVersion=0.1.0
+
+      - name: Upload external consumer evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: token-pilot-0.1.0-external-consumer-evidence
+          path: build/reports/external-consumers/0.1.0
+          if-no-files-found: warn

AGENTS.md

@@ -390,6 +390,17 @@ Verify the published Spring AI adapter API and the starter with one explicitly s
 ./gradlew verifyPublishedIntegrationConsumer
 ```
 
+Verify isolated external Core and Starter consumers from the exact staged
+version, including dependency evidence and expected negative failures:
+
+```bash
+./gradlew verifyExternalConsumers -PprojectVersion=0.1.0
+```
+
+The protected manual release-candidate workflow runs this gate with signing
+secrets in the `release` environment. Pull-request CI remains secretless and
+uses the default snapshot version.
+
 Run the complete release-candidate gate, including module-local staging and
 binary/source/Javadoc/POM/module-metadata artifact checks:
 
@@ -452,6 +463,9 @@ Stage and deploy a Central release:
 - Added root publication aggregation and a release-candidate verification gate
   that stages every public module and checks the complete artifact/signature
   set for the selected version.
+- Added isolated external Core/Starter consumer verification with fresh cache,
+  dependency evidence, negative artifact/version scenarios, and a protected
+  0.1.0 release-candidate workflow.
 
 ### 2026-08-25