release: bind canary and incident evidence - #126

Summary

• require manual, T+24h, and T+72h RC canary manifests in the production-readiness input
• require timed canaries to come from schedule events and bind every canary to the attested RC tag, commit, and image digest
• require separately hashed fail-closed promotion incident evidence
• propagate the verified canary and incident identities into the generated readiness JSON and stable tag gate
• fail clearly when the installed GitHub CLI lacks attestation support

Why

The graduation tracker required these artifacts, but the readiness generator did not consume them. A stable report could therefore have reached ready without the timed canaries or incident note. This closes that evidence-contract gap before campaign 1.

This changes release evidence tooling and documentation only; it does not alter the supported CLI, Action, QEMU runner, report behavior, candidate binaries, or immutable RC artifacts, so it does not reset the RC observation window.

Validation

• bash scripts/production-readiness-report_test.sh
  • accepts a complete fixture
  • rejects a missing T+72h canary
  • rejects a workflow_dispatch result presented as T+24h
  • rejects incident evidence without its completion marker
  • retains duplicate-campaign and infrastructure-error rejection
• go test ./...
• actionlint v1.7.11
• make check-docs-drift
• git diff --check
• candidate attestation verified with checksum-verified GitHub CLI 2.96.0