Define Recovery/Installer artifact build lane (docs, fixture, Makefile, maturity)

[Copilot]

Adds the next bounded M2 platform-proof slice: a concrete artifact build lane definition for SourceOS Recovery/Installer artifacts. Docs/fixtures/validation only — no host mutation, disk writes, or real builds.

What's new

• docs/RECOVERY_INSTALLER_ARTIFACT_BUILD_LANE.md — design doc for the build lane:

  • Distinguishes the build lane (artifact production) from the packaging step (BootReleaseSet assembly)
  • Defines all required artifact classes with roles, per-artifact SBOM/provenance refs, and platform scope
  • Documents the 7-stage pipeline (source fetch → build → manifest → SBOM → provenance → sign → output), all side-effect-free in dry-run mode
  • References NLBoot at release-candidate status; notes SBOM proof is pending — no tagged release invented
  • Maps lane artifact classes to BootReleaseSet.spec.artifacts fields

• examples/artifact-build-lane/recovery-installer-build-result.example.json — dry-run ArtifactBuildLaneResult fixture covering all nine artifact classes:

  class	role
  bootstrap-payload	bootloader (m1n1+U-Boot for M2; UEFI stub for x86)
  recovery-kernel	kernel
  recovery-initrd	initrd
  recovery-payload	recovery-image
  installer-payload	installer-data
  manifest	manifest
  checksums	other (SHA256SUMS)
  sbom-reference	other (SPDX doc)
  provenance-reference	other (SLSA/in-toto bundle)

  Platforms: apple-silicon (M2, first-class), uefi-x86_64, generic-arm64. All digests are placeholder zeros; _dryRun: true / execute: false guards present.

• Makefile — adds python -m json.tool syntax validation for the new fixture.

• repo.maturity.yaml — adds evidence entries for the new doc and fixture; adds next actions for SBOM proof completion, Sigstore automation, and wiring lane output into the packaging step.