[Epic] Release engineering and supply-chain hardening

[plx]

Parent

#26

Objective

Create a reproducible and reviewable path from an audited commit to crates.io and GitHub release artifacts. This epic owns MSRV/dependency policy, workflow pinning and least privilege, Cargo package boundaries, quality/release gates, v0.2 identity and licensing clarification, artifact provenance, and repository/tag protections.

Why this blocks release

Current HEAD still declares the already-published 0.1.4, breaks the published public API, and has no tag or GitHub Release. Rust 1.70 is claimed but unsupported. Sensitive workflows execute mutable action tags. Cargo packaging ships unrelated site/internal content, and there is no reproducible publish pipeline or tested binary artifact flow.

Workstream order

1. Choose and enforce the MSRV; pin and minimize workflows; constrain package contents.
2. Finalize the public API and deliberate v0.2/license/changelog identity.
3. Add all-OS quality, package, SemVer, advisory, attribution, and artifact gates.
4. Configure trusted publishing, protected release state, checksummed artifacts, SBOM/provenance, and smoke tests.

Completion criteria

• One declared MSRV works with the committed lockfile and clean install.
• All third-party actions are immutable and token-bearing jobs are least-privilege.
• Cargo packages only intentional runtime/legal/user documentation files.
• Version, tag, CLI, changelog, license clarification, and SemVer baseline agree.
• Release workflow produces traceable, smoke-tested crates and cross-platform artifacts from one commit.
• Required checks and release tags/environments are protected.

Relationships

• Parent epic: [Epic] Production readiness and formal v0.2.0 release #26
• Native child and dependency links will be added after leaf creation.
• Publication is a separate final ticket blocked by the independent audit; this epic prepares and rehearses the mechanism but does not publish.

Non-goals

Do not reuse 0.1.4, retroactively mutate its artifact, or publish while the final production audit is incomplete.