feat: release reviewed versions with verified build provenance

[narenaryan]

Outcome

Release Scharf from a reviewed version/notes PR instead of requiring a separately authenticated desktop/CLI to create a tag. Merging this initial PR requests and publishes v1.4.2, including merged #61/#62; this PR itself publishes nothing. The user retains merge control.

Trust boundary and permissions

Only a push to cybrota/scharf main changing release/version.txt can publish. The exact event SHA is checked out and tested after deterministic version metadata generation. The same originating workflow creates the tag, builds five ZIPs/checksums, signs GitHub/Sigstore provenance, verifies repository/workflow/source-SHA/source-ref identity, and publishes a draft only after all bytes pass verification. This avoids GITHUB_TOKEN-created tags failing to trigger a separate workflow.

Only the release job receives contents:write, id-token:write, attestations:write. Read-only PR jobs cannot publish/sign. No new PAT, stored signing key, settings/secrets changes, auto-merge, or cross-repository token. Homebrew remains a separate reviewed PR after independent artifact verification.

Failure behavior

Strict stable semantic-version ordering uses all tags (v1.4.1 baseline, preserving historical misnumbered v0.5.1). No forced tag movement, asset replacement, or published-release modification. Reruns accept only the identical tag commit and exact matching existing asset bytes; incomplete matching drafts resume. Mismatches fail closed. External administrators remain trusted and API operations cannot be atomic against unrelated writers.

Validation

• 39 offline stdlib regression tests passed: unauthorized contexts, malformed versions, stale/mismatched tags, API failures, checksum corruption, interrupted uploads, repeated events and final-byte/tag races.
• Official Go 1.26.9 toolchain archive verified against go.dev SHA256; go mod verify, go test ./..., go vet ./..., go test -race ./... passed, including generated v1.4.2 metadata. No new global installation.
• Python compilation, YAML parsing, hook-generated JSON and git diff --check passed.
• Independent security review using the user's ai-bug-patterns skill: findings fixed, no remaining blockers.
• PR CI adds a read-only GoReleaser snapshot build using the declared Go 1.26.8 toolchain. Pending at submission.
• Live OIDC signing and publication are intentionally untested before the maintainer merges. govulncheck unavailable locally; not claimed passed. agentskb operations consulted: none available.

Docs and sources

See docs/releasing.md and ADR 006 for bootstrap, retry, verification and Homebrew procedure. Primary references: GitHub attestations, workflow token triggers, gh verification, GoReleaser reproducible builds.