build(release): package the CLI with SBOM and provenance

[back1ash]

Summary

Produce traceable, content-addressed alpha artifacts for the CLI, core, validator worker, contracts, and built-in rule pack.

Scope

• Build supported platform artifacts from the locked workspace.
• Generate dependency inventory, SBOM, license metadata, and vulnerability observations.
• Record source commit, toolchain, runtime, core, validator, rule-pack, and schema identities.
• Sign or attest release artifacts and publish content digests.
• Document verification and reproduction commands.

Acceptance criteria

• Every artifact has a SHA-256 digest and provenance manifest.
• Artifacts contain only intended runtime files and versioned schemas or rule data.
• Fresh supported hosts can verify and run the packaged CLI.
• SBOM and dependency locks correspond to the shipped artifact.
• Release failure cannot publish a partial stable release.

Dependencies

• test(core): prove deterministic CLI and cross-platform parity #27

Priority gate and claiming

Keep status:blocked until every open priority:p0 issue is closed
and every explicit dependency above is closed. Only then replace it
with status:ready and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• A stable 1.0 release, hosted deployment, pricing, or private distribution.
• Legal conclusions beyond recording declared license metadata.