Release Provenance

Release provenance

Two related but distinct questions, both answered canonically in NebulaOS-firmware:

• "Which factory and which source produced this build?" — Build Provenance. Every build writes build-manifest.txt, recording the exact commit of this repo's components, the digest-pinned build image used, and hashes of every fetched/built artifact and the final flashable images.
• "Is every third-party thing this build fetches (Mainsail, WiFi firmware, etc.) itself reconstructable from its own upstream?" — NEBULAOS_RELEASE_ARTIFACT_PROVENANCE.md in NebulaOS-firmware.

Once a release is published under Releases, the release notes document the exact component revisions it was built from (releases/RELEASE_TEMPLATE.md), so its provenance can always be independently reconstructed from the four source repos.