Publish version tags automatically and install the latest release with one command

[SaladDay]

Outcome

Pushing a version tag now runs the shared repository checks, builds the existing Linux amd64 distribution, and publishes its matched assets in the same tag's GitHub Release. Prerelease suffixes produce prereleases. Manual runs remain artifact-only or draft-only.

Each release includes a standalone install.sh and checksum. It defaults to the latest stable release, accepts --version, downloads one fixed release's offline archive, verifies it, rejects unsafe extraction paths, and delegates to the existing installer. README, the installation guide and the landing page use the short public installation command. No GitHub login is required.

The combined Runtime image also drops retired inner-sandbox files and settings that blocked distribution builds. Native Harness startup checks remain in the image build.

Publication is bound to the Release ID returned by creation. Existing drafts/releases are refused; upload failures and unknown write results preserve state without deletion, overwrite or automatic replay. The tag is rechecked after upload, before publication. Only the publication job has repository write permission.

Boundaries

No image registry publishing, changes to Runtime execution, existing-installation upgrades, private download authentication or new platform support. No real version tag or public Release was created during development.

Validation

• 18 publication tests and 13 bootstrap tests pass, covering unknown write outcomes, moved tags, existing drafts, latest/explicit versions, corrupt archives, unsafe paths, data preservation and argument forwarding.
• Final-source make check-distribution passes remotely; workflow lint and native daemon/installer CI pass on Linux, macOS and Windows.
• Full make check passed in artifact-only run 36520844816. Later changes are confined to publication, bootstrap, documentation and distribution packaging, covered by focused checks. The first actual image build exposed retired inner-sandbox paths; those are removed.
• Final-source full distribution build, packaging, image/native verification and artifact upload passed in 13m00s in artifact-only run 36524284426, using the existing main workflow and the PR's exact source SHA. That existing workflow does not stage the new standalone bootstrap; its staging and behavior are covered by the workflow/static and fixture tests.
• A previous PR check hit the unchanged 60 ms preparation-expiry test; 20 consecutive remote reruns passed and the same Runtime code passed the full release gate. No Runtime behavior or timing-test changes are included.
• Final-head full make check CI also passed: run 36524251964, 29m10s for the job. All final PR checks passed.
• Fresh independent review of the final complete diff found no substantiated in-scope issues.

The first version tag after merge will exercise real GitHub publication and public downloads. Development used artifact-only builds and deterministic API/archive fixtures; no real version tag or Release was created.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}