BROKEN - v0.1.54 (do not install)

Niro v0.1.54

Summary

This release adds a documented, guarded Community Edition release process and
stable, dev, and release-candidate installation channels while preserving the
same public installer URLs.

Changes

• Added explicit Community Edition support, security-reporting, release-note,
  and artifact-verification guidance.
• Added a dedicated dev/RC workflow that builds version-matched CLI and
  attack-tool sandbox artifacts from one reviewed source commit.
• Added retrying exact image-tag verification so a brief registry propagation
  delay cannot strand a release after a successful multi-architecture push.
• Made transactional draft lookup compatible with the GitHub CLI versions used
  by hosted release runners.
• Added NIRO_CHANNEL=stable, NIRO_CHANNEL=dev, and NIRO_CHANNEL=rc to the
  macOS, Linux, and Windows installers.
• Kept NIRO_VERSION as an exact stable, dev, or RC pin and made conflicting
  or malformed selectors fail before download.
• Hardened stable CLI and image publication, including guarded recovery of the
  image latest tag.

Security

Stable workflows now reject prerelease tags before testing or publication, and
manual image recovery cannot move latest without validating current public
release state. Prerelease publication rejects reused versions and verifies
staged release-asset digests before making a release public. No developer
agent, attacker agent, attack-tool sandbox, CLI permission, or target-access
behavior changed.

Compatibility and upgrade

There are no CLI, MCP, configuration, or runtime compatibility changes. The
default installer still selects the latest stable release. NIRO_VERSION=latest
is no longer a valid exact pin; omit selectors or use NIRO_CHANNEL=stable
instead. Existing exact vX.Y.Z pins continue to work.

Known issues

• checksums.txt covers the platform archives but does not yet include
  niro.mcpb.
• Release artifacts do not yet include detached signatures, a public binary
  provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC, and Windows users must
  rerun the installer to change versions.