OpenLakeForge 0.1.0-alpha.1

OpenLakeForge 0.1.0-alpha.1

The first publishable OpenLakeForge alpha: a signed, SBOM'd, provenance-
attested release bundle built from the seed multi-product POC (Sales
order_revenue and customer_health, Supply Chain
inventory_reliability) across the local (kind), Azure POC (AKS), and AWS
POC (EKS) deployment targets.

• .github/workflows/release.yml: tag-triggered (v*) and
  workflow_dispatch (dry-run capable) release pipeline. Builds and pushes
  project-code and superset images to ghcr.io/malon64/openlakeforge/*
  by digest, signs them keylessly with cosign (Sigstore OIDC, no long-lived
  keys), generates an SPDX SBOM per image attached as both a cosign
  attestation and a release asset, attaches SLSA build provenance via
  actions/attest-build-provenance, and publishes the GitHub Release with
  the changelog, the component manifest, the compatibility matrix, and
  checksums.txt.
• olf release CLI group (tools/olf/olf/release.py): manifest,
  checksums, compatibility-matrix, and check (the release-readiness /
  clean-install consistency gate).
• make release-check and make release-bundle targets, and a
  release-check job in .github/workflows/checks.yml so release drift is
  caught on every pull request, not only at tag time.
• docs/release/releasing.md and docs/release/compatibility-matrix.md.
• scripts/release/verify-install.sh: the scripted clean-checkout install
  verification a consumer (or the maintainer, post-merge) runs against a
  published tag.

This is the first tagged release; there is no prior version to migrate
from. Consumers adopting this alpha should:

1. Pin to the immutable tag v0.1.0-alpha.1 (or the resolved image
   digests recorded in the release's component-manifest.json) rather than
   :local or main.
2. Follow docs/release/releasing.md to verify
   signatures and checksums before deploying.
3. Expect breaking changes in the next alpha; this stage carries no forward
   compatibility guarantee (see "Lifecycle Definitions" in
   docs/industrialization-roadmap.md).

• No stable support window is published before v1.0; only the latest
  alpha tag is maintained.
• The Azure POC and AWS POC deployment targets remain proof-of-concept
  scope; see docs/architecture/aws-eks-poc.md for the current AWS
  compatibility gate.

Verification

See docs/release/releasing.md for the full
consumer verification walkthrough (cosign signature verification,
checksum verification, and the clean-checkout install check).