[S8] Release engineering + API-stability gates

[rickylabs]

Child of the Road-to-0.0.1-stable umbrella. Release engineering + API-stability machinery for the road to beta/stable.

Scope

• Beta-cut mechanics: prove the one-shot deterministic release:cut by cutting 0.0.1-beta.x with it (env-split: deno on Windows, gh via WSL). Close the version:bump wrapper gaps (fix(publish): JSR first-publish package provisioning + one-shot e2e CI + deterministic release tool #122-class: workspace-root deno.json version + deno.lock @netscript/* mirror not updated by the wrapper).
• Public-surface-diff CI gate: snapshot deno doc --json per package, diff vs the previous tag, classify each change major/minor/patch, fail on undeclared breaks. This is the enforcement for the doctrine 10-versioning-and-lifecycle policy (S4).
• Deprecation policy enforcement: @deprecated{removal: x.y} convention + a gate; deprecation window.
• Release hard-gate wording: encode "publish.yml all-green AND e2e-cli-prod green = release done; red = real defect, fix-forward" into netscript-release skill.

Dependencies

Depends on S4 for the semver/versioning/deprecation policy it enforces; feeds the 0.0.1-stable API-stability criterion. Publishing stays in CI via OIDC — never local.

Acceptance criteria

• (beta) release:cut cuts the beta in one shot, deterministically; version-bump wrapper leaves zero manual edits.
• (stable) public-surface-diff gate live in CI; deprecation policy enforced; no undeclared breaking change can merge.

---

Parent epic: #301

Part of #301