feat: package immutable policy releases

[jmcte]

Summary

• package Flow policy as deterministic, offline-verifiable versioned release assets with per-file SHA-256 digests
• define exact immutable consumer references and patch/minor/major upgrade gates with independent-review and ADR requirements
• add guarded immutable GitHub publication, notification, post-publication download verification, and CI preflight coverage

Governing Issue

Closes #12

Validation

• python3 -m json.tool passed for all tracked schemas
• python3 scripts/flow/validate_policy_bundle.py — passed
• python3 scripts/flow/validate_transition.py — passed
• python3 scripts/flow/evaluate_contribution.py — passed
• python3 scripts/flow/validate_provenance.py — passed
• python3 scripts/flow/build_policy_release.py --output /private/tmp/flow-policy-release-pr20 --version 1.0.0 --verify — passed
• python3 -m unittest discover -s tests -v — 67 passed
• git diff --check origin/codex/flow-contribution-lifecycle-policy...HEAD — passed
• Required PR checks are expected to satisfy CI Gate
• Skipped checks: no live release publication; immutable releases remain disabled until the reviewed Bootstrap/GitHub-policy plan is applied after merge

Bootstrap Governance

• Changes are scoped to Flow Publish an immutable v1 policy bundle and migration contract #12
• Contributor and PR guidance are unchanged; the release workflow and policy assets are product-owned work for this issue
• PR author will enable squash auto-merge after PR creation where GitHub allows it
• No real secrets, runtime auth, or machine-local env files are committed

Flow Contract

• Owner lane: Pheidon
• Repair owner: Pheidon
• Autonomy class: review-gated autonomous
• Risk class: release policy and supply chain

Flow Merge Readiness

• Every blocker has a next actor and next action: PR feat: define contribution and policy-release contracts #17 must merge first; then a non-author reviewer must approve this current head and CI must pass
• No active blocking requested changes remain
• Non-author GitHub approval is present when required
• PR author will enable auto-merge after retargeting where GitHub allows it

Merge Automation

• PR author will enable auto-merge with gh pr merge --auto --squash after retargeting

Notes

This PR intentionally stacks on #17 because the release inventory includes the contribution-policy evaluator. It is release-ready code, not a production release: the workflow fails closed unless the repository enables immutable releases and all release evidence gates pass. No tag, release, or GitHub policy setting is created by this PR.

[jmcte]

Superseded by #21.

Because #20 targeted an unprotected feature branch, GitHub merged it immediately into that branch when auto-merge was requested. The parent branch has been restored to its contribution-policy-only head so #10 remains reviewable on its own. #21 recreates the identical validated release-only stack behind #17 without auto-merge; do not treat #20 as a landing into main or as closure of #12.