Add a verified release gate

[itsjling]

Closes #39.

Summary

• run the full product gate before versioning or publishing
• inspect the packed file list and test the installed tarball as a real consumer
• publish through a protected trusted-publishing workflow with npm provenance
• document release proof, failure recovery, and the current audit state

Stack

Base: codex/issue-018-ci-product-gate (PR #47).

This PR should land after #47 so releases use the shared product gate.

Verification

• corepack npm@11.5.1 run check
• npx fallow audit --base codex/issue-018-ci-product-gate
• release workflow YAML parse

Scope

No package was published and no version or tag was created.

Stack

1. Add a clean-checkout product gate #41
2. Run the full product gate on every pull request #47
3. Add a verified release gate #49 👈 current

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de619df52e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[itsjling]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aa545e3c43

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".