feat(server): establish clean-room foundations

[zoeyrose]

Closes #1.
Closes #2.
Closes #3.
Closes #4.
Closes #5.
Closes #21.

Summary

• establishes the pinned Go 1.26.5 module, version/config shell, lifecycle, inward-facing contracts, and deterministic bounded simulation harness
• records the independent-implementation, module provenance, fresh-world, behavior-inventory, architecture/concurrency, expression-host, and observability decisions
• adds bounded structured logs, safe OpenTelemetry spans, registered OpenMetrics snapshots, readiness/liveness semantics, and authenticated immutable diagnostics
• adds fail-closed dependency/license policy, generated notices, deterministic Linux/Windows/source release packages, SBOM, checksums, provenance, and semantic release
• publishes one aggregate Server validation check over Linux QA/race/fuzz/security/release validation and Windows build/tests

Provenance

All Go code and synthetic tests are newly authored from the linked public issue contracts. No classic GPL source, tests, fixtures, runtime Python, or historical MIT provenance grant was used. The server links only aggregate ownership/count/digest evidence from the canonical independently reviewed content inventory at atrinik/content@60a3a53c4e3e64293cdba21c91caf0c7a618764d.

Deep review

The ignored workspace report is build/deep-review-server-m1.md. Two review iterations addressed stale generation reuse, arithmetic/sequence overflow, shutdown panic containment, immutable payload ownership, metrics lock contention/overflow/input mutation, telemetry field and trace privacy, diagnostics authentication, false readiness, build/source correlation, path/port validation, release tooling, fail-closed license checks, generated notices, action governance, command coverage, metrics completeness, benchmark coverage, and explicit failure ownership. No review finding remains.

Automated validation

• tools/validate.sh
• actionlint and ShellCheck
• Trivy HIGH/CRITICAL vulnerability, secret, and misconfiguration scan
• 50 repeated concurrent queue/metrics stress runs
• Linux/Windows/source artifact inspection and byte-for-byte reproducibility comparison

Manual verification

From the atrinik/atrinik wrapper root:

./atrinik worktree list server
cd workspace/worktrees/server/m1-foundations
env PATH=/tmp/atrinik-m1-tools/go/bin:/usr/local/go/bin:/usr/local/bin:/usr/bin:/bin tools/validate.sh
go run ./cmd/atrinik-server version
ATRINIK_ADMIN_TOKEN=0123456789abcdef0123456789abcdef go run ./cmd/atrinik-server config

Expected results: validation succeeds; version reports semantic/build/Go/target/protocol/content coordinates; config prints "admin_token":"[redacted]" and never prints the credential. M1 intentionally has no playable replacement topology or listener, so no up lifecycle is claimed.

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• v1.0.0
• GitHub release

Your semantic-release bot 📦🚀