fix(release): rehearse production paths before release

[jeremi]

Summary

• add a read-only Ubuntu future-tag rehearsal for release branches, including exact archive-lock reproduction and production-shaped /dev/ docs checks
• expand the release planner across native client packages, generated loaders, excluded fuzz locks, archive identity, and active docs release surfaces
• correlate candidate dispatches to one unique Actions run, with optional exact-source CI and candidate waits
• add an independent public release verifier for tag, asset, checksum, Sigstore, manifest, OCI, and binary identity
• move artifact upload/download actions to their current Node 24 releases
• centralize production docs builds and fix machine-readable discovery URLs under /dev/

The rehearsal runs before the release PR and outside the release clock, so it does not lengthen candidate publication.

Security review

• rehearsal permissions are contents: read, it requires an absent future tag, and it contains no publish or artifact-upload path
• dispatch inputs cross the shell boundary through environment variables and are validated before use
• candidate run ownership is bound to a unique 128-bit request ID and exact source SHA
• public verification fails closed on asset API digests, exact checksum and manifest payload closure, protected-main Sigstore identity, final OCI digests, and source identity
• the native smoke receives no inherited credentials

No runtime authentication, authorization, disclosure, audit, or signing behavior changes.

Verification

• python3 -m unittest discover -s release/scripts -p 'test_*.py' (273 passed)
• focused post-rebase release tests (163 passed)
• npm test in docs/site (327 passed)
• npm run check:production in docs/site (236 machine-doc assertions and 25,858 links/assets passed)
• python3 release/scripts/check-gates-inventory.py (118 gates passed)
• python3 .github/scripts/test_ci_changes.py (50 passed)
• actionlint
• release/scripts/registry-release validate-current
• release/scripts/registry-release validate-docsets
• REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
• release/scripts/registry-release verify-public --tag v0.20.1 (39 assets, 37 checksum payloads, one OCI image, native smoke passed)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bdb213b70b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dfbcf8fa92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".