[Release] Qualify a stable installable Flow suite after the provider and Flow audits #72

Suite roadmap: #11
Depends on: #54, #12, egohygiene/aniflow#17, egohygiene/optiflow#61, and egohygiene/renderflow#409

Outcome

Publish a stable, independently installable Flow suite after the first integration-candidate release and repository audits. A new user can install the flow command and its compatible independent providers, run the advertised local-file workflows, inspect evidence/recovery, and trust that every advertised capability is backed by a released, verified contract.

Scope

• Reconcile the suite's supported-v1 capability/profile matrix from released provider artifacts and actual clean-room evidence. Separate baseline local-file/static/temporal workflows from optional or experimental lanes; each outstanding issue must be completed, linked to bounded remediation, or deliberately scheduled after v1.
• Resolve findings from the three provider audits and the final Flow audit before claiming stable readiness. Re-run only the compatibility and release gates needed for the selected supported matrix.
• Freeze and publish the Flow version, provider compatibility lock, installer/bundle/Cargo-channel truth, checksums, SBOM, provenance/signing evidence, support matrix, migration/rollback guidance, and durable examples from a reviewed green commit. Never reuse an immutable tag or silently replace a provider release.
• Verify a fresh supported-platform installation and a small local-file suite that exercises read-only inspection, one static publication route, one temporal route, missing-provider refusal, interruption/resume, and uninstall/rollback. Effectful Optiflow and optional creative/music-video profiles are advertised only after their own released contracts and separate Flow proofs are complete.

Acceptance criteria

• The audit findings and explicit deferrals in [EPIC] Finish the flow suite and prove production-ready orchestration #11 have an owner, evidence, and disposition.
• The exact shipped flow binary and independent holon artifacts match the published lock and capability documentation on supported targets.
• Clean-install positive and negative workflows run from artifacts, with no sibling source checkout or private media.
• Versioned authority, recovery, validation, provenance, diagnostics, privacy, licenses, and rollback behavior are demonstrated end to end.
• Registry, bundle, and package-manager claims are limited to channels actually published and tested; the occupied crates.io name flow is never presented as ours.
• [EPIC] Finish the flow suite and prove production-ready orchestration #11 can close with links to exact commits, release assets, tests, accepted limitations, and deliberate post-v1 lanes.

Non-goals

Forcing every optional HTTP, screenplay, podcast, music-video, watermark, or optimization profile into v1; publishing without review; or claiming a universal format router.