release: add provenance evidence bundle

[JeremyDev87]

What

• Add candidate-release evidence for the root npm tarball, including filename, SHA-256, expected dist-tag, and workflow URL.
• Add fail-closed published-release provenance checks for tag SHA ↔ publish-run head SHA and exact latest/next dist-tags across the root package and optional native addon packages.
• Validate release tags with the trusted default-branch helper before checking out an explicit refs/tags/... target, and pass event metadata through environment variables instead of shell interpolation.
• Add shared release-contract helpers and regression fixtures for stable, prerelease, malformed, missing, wrong-version, missing-package, workflow-order, and CI-reachability cases.
• Run the release-evidence contract suite in every PR-triggered Node CI matrix lane.

Why

Release verification must leave an inspectable candidate/package/provenance receipt and must not silently accept missing or mismatched registry evidence.

Scope / boundaries

• Implements issue [v1 readiness][kratos] Release provenance and workflow evidence bundle #94 only; package.json remains unchanged because the issue marks it inspect-only.
• No version bump, tag creation, npm publish, GitHub Release creation, workflow dispatch, or merge/auto-merge.
• Candidate workflow does not query the registry before publish; published follow-up performs the exact registry audit after a successful publish run.

Validation

• npm run verify — PASS (9 passed, 1 environment-gated native smoke skipped)
• node --test test/release-evidence.test.js — PASS (6/6)
• malicious tag shell-interpolation probe — invalid tag exit 1, probe file not created
• cargo test --workspace — PASS
• cargo clippy --workspace --all-targets — PASS; existing warnings only
• actionlint 1.7.12 — PASS for the three changed workflows
• Ruby Psych YAML parse — PASS for the three changed workflows
• node --check scripts/lib/release.mjs — PASS
• git diff --check — PASS

Risk / follow-up

• Live published-release registry and GitHub Release verification is intentionally not executed in this PR; it is exercised only by the published follow-up workflow after a real release.
• Current-head PR checks and exact-head re-review must complete before ready status.

Closes #94

[JeremyDev87]

현재 head 전체 diff 리뷰에서 High blocker 2건을 확인했습니다. 상세 verdict와 검증 근거는 별도 top-level ddalggak review comment에 기록합니다.

[JeremyDev87]

PR #99의 current head 전체 diff와 두 remediation을 재검토한 결과 차단 이슈가 없습니다.

Verdict: approve
├─ PR: #99 @ 7cd860503a965d450550d3c16571b1f0a905c5c6
├─ Blockers: Critical 0 / High 0 / Evidence gaps 0
├─ Feedback: accepted 2 / countered 0 / deferred 0 / unresolved 0
└─ 상태: ready for review; human manual merge 대기

검증 근거 / Checks

• 전체 scope: master@574fa705… → current head의 5개 파일 전체 diff, release candidate/published follow-up call chain, CI test reachability
• review remediation commit: 7cd860503a965d450550d3c16571b1f0a905c5c6
• 두 기존 thread에 commit·검증 증거를 reply했고 GraphQL readback에서 2/2 resolved·not-outdated를 확인했습니다.
• current-head CI run 29577479037: 10/10 terminal success
• Node 18/20/22/24 각 job 로그에서 Run release evidence contract tests와 6/6 PASS를 readback했습니다.
• isolated review worktree /tmp/kratos-pr99-review: focused 6/6, npm run verify, actionlint, Ruby Psych YAML, git diff --check 모두 exit 0
• author worktree: cargo test --workspace, cargo clippy --workspace --all-targets, Node syntax 모두 exit 0; clippy는 기존 warning만 있습니다.
• malicious tag shell-interpolation probe: invalid tag exit 1, probe file 미생성

Finding closure / Scope / Boundary

• validation-order finding: original thread → trusted default-branch helper 검증 후 명시적 refs/tags/... checkout으로 해소
• CI-reachability finding: original thread → PR-triggered Node matrix 4개 lane에 focused suite 연결 및 실제 로그 확인
• 추가 hardening: raw release event/input 값은 shell source interpolation 대신 환경변수로 전달하며 회귀 테스트로 고정했습니다.
• package.json은 unchanged이고, 변경은 issue #94의 release workflow/helper/test evidence 범위입니다.
• 실제 published-release registry audit은 real release 뒤 follow-up workflow 소유이므로 이번 PR에서 미실행은 의도된 경계입니다.
• version bump/tag/publish/workflow dispatch/release/merge/auto-merge는 수행하지 않았습니다.

Wiki Context Manifest

• repo-specific canonical page는 없었습니다.
• 적용 authority: [wiki: domains/principles/alex-core-invariants.md], [wiki: domains/principles/red-ci-is-a-signal-not-an-obstacle.md].
• 적용 판단: trusted verifier → target authority 순서, 신규 contract test의 PR CI reachability, fail-closed mismatch 처리.

CI / formal review / merge boundary

• CI/check: current head 10/10 success.
• formal review: PR 작성자 계정의 self-review이므로 GitHub formal approval로 주장하지 않습니다. reviewDecision=REVIEW_REQUIRED는 CI와 별도입니다.
• merge blocker: branch protection·human review 요구는 그대로 유지됩니다.
• human action: 주인님 수동 merge만 가능하며, merge/auto-merge는 수행하지 않았습니다.

REVIEW_DONE PR#99 head=7cd860503a965d450550d3c16571b1f0a905c5c6 verdict=approve critical=0 high=0 gaps=0