release: finish Syndrid v0.1 production publication path

[cmahmud]

Summary

Scopes the Syndrid v0.1 production path to Syndrid-owned GitHub Release artifacts for the primary terminal platforms:

• Windows: x86_64-pc-windows-msvc (mandatory) and aarch64-pc-windows-msvc (retained when green), built on GitHub-hosted windows-latest runners.
• Linux: x86_64-unknown-linux-musl (mandatory) and aarch64-unknown-linux-musl (retained when green), built on hosted Ubuntu runners with keyless Sigstore/cosign signing through GitHub OIDC.
• macOS production artifacts/signing/notarization are deferred beyond v0.1 and are not in the publication dependency graph.

Windows v0.1 packages are intentionally unsigned: Azure Trusted Signing/AuthentiCode and the nonexistent azure-artifact-signing environment are not required. The dormant signing action remains available for a future signed release. Windows package construction still verifies the exact Syndrid entrypoint/resource layout; release staging enforces SHA-256 manifests, deterministic archives, exact target collection, and staged package smoke testing.

The tag gate remains version-bound and proves the tagged commit descends from main. GitHub Release assets use overwrite_files: false, and inherited npm, DotSlash, WinGet, Python-wheel, shell-manifest, moving-ref, upstream docs, symbols, and other OpenAI/Codex publication channels remain disabled.

Validation

• Exact head: 66fa22f29442830166d8bf07117aa729a54c7cc9.
• V8 canary run 33343266067 (bump(version): 0.1.2504220136 openai/codex#518): success.
• Exact-head blocking run 33343266206 (add check to ensure ToC in README.md matches headings in the file openai/codex#541): still running; repo-checks is green. Cargo Deny currently reports inherited h2 0.4.13 / RUSTSEC-2026-0258, also present on current main and isolated in PR security: update h2 past RUSTSEC-2026-0258 #137.
• No v0.1 tag or production publication has been created.

[cmahmud]

Current convergence status: exact-head V8 is green and the PR remains mergeable with no review threads. The production workflow is now GitHub-Release-only and removes inherited npm/DotSlash/docs/WinGet/moving-ref publication. The remaining deliberate v0.1 blocker is macOS signing authority: the workflow still uses the repository codesigning environment/AKV notarization path, and the frozen audit still rejects that inherited signing assumption. I am not renaming, bypassing, or weakening signing without evidence that a Syndrid-owned environment/authority is configured and authorized. Blocking CI is queued; no branch-specific CI regression has been observed.