[U30] Rehearse immutable app/CLI release artifacts

[ZempTime]

PRD: #1
Delivery unit: U30
Campaign: C09
Canonical graph: https://github.com/ZempTime/shortbread/blob/246320c73d81e5afdf0490b43a2b02272f40268b/docs/initiatives/2026-07-shortbread-v1/05_delivery_replan/output/2026-07-20-delivery-plan.md
Common unit contract: https://github.com/ZempTime/shortbread/blob/246320c73d81e5afdf0490b43a2b02272f40268b/docs/initiatives/2026-07-shortbread-v1/05_delivery_replan/output/UNIT-CONTRACT.md

• Acceptance umbrella / blockers: GitHub Produce release-candidate application and CLI artifacts #12; blocked by U28 and U29.
• Outcome: Least-privilege pinned CI produces draft/prerelease app and CLI artifacts, and a clean production-shaped checkout installs them and completes the Shortbread actor smoke without rebuilding from source.
• Failure/recovery: Missing provenance/checksum/SBOM, mutable tag/image reference, permission excess, incompatible app/CLI, failed migration/health, and artifact unavailability block promotion.
• Evidence: CI workflow review, artifact download/install/checksum, image digest, compatibility smoke, license/security scan, and release/operations review.
• Central surfaces / impact: GitHub workflows, package/release configuration, immutable references. Stable promotion remains U38.
• Safe split: CI publication and clean install may checkpoint separately, but the issue remains open until published candidates pass the smoke.

Every integration records a factory candidate with evidence or No reusable harvest.