v0.13.161

Verifying this release

Each binary is signed keylessly with cosign (Sigstore,
GitHub OIDC — no long-lived keys). Verify a download against its bundle:

cosign verify-blob \
  --bundle sail-linux-amd64.cosign.bundle \
  --certificate-identity-regexp '^https://github.com/standardapplied/sail/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  sail-linux-amd64

The .sha256 files remain for a plain checksum check.

What's Changed

• Scope the stop gate's readiness checks to the spec's repos by @udaychandra in #149
• Sync the review pipeline's status transitions to main immediately by @udaychandra in #150
• Brick 1: reviews sync to main as a replicated aggregate by @udaychandra in #151
• Bricks 2+3: main narrates the loop from synced state; Slack goes main-only by @udaychandra in #152
• Make the review loop resilient to out-of-band status writes by @udaychandra in #153

Full Changelog: v0.13.160...v0.13.161