Prepare and verify the v0.2.3 release

[jmcte]

Objective

Prepare the existing v0.2.3 release target from current main and complete the signed, verified Linux image publication. This work is authorized by the maintainer's request to check recent developments and work the issues needed for a fresh release.

Current evidence (2026-09-06)

• Latest GitHub Release is v0.1.11. Main is 92cb963 and package/default Linux image versions are 0.2.3.
• Release Image run 30370859615 failed while attaching the SBOM to a staging candidate after Rekor returned a service error; final promotion and GitHub Release were skipped.
• The canonical runner is 2.336.0; official actions/runner v2.337.0 was published 2026-08-26.
• Main's full local baseline passes: 54 test files, 324 tests, plus TypeScript lint. Hosted CI has a recurring timeout in the independent-process audit rotation regression.
• CodeQL update PRs are failing because independently updated init/analyze/upload-sarif actions diverge. Current main remains internally aligned.
• Nightly governance inspection fails with HTTP 403 after the managed-file drift plan passes; mutation testing exceeds the existing job budget. These remain separately identified external/extended-validation limitations.

Scope and acceptance

• Refresh the shared runner version and verify the resulting manifests against the official release.
• Repair the audit regression harness without weakening the independent-process rotation assertions.
• Fix any demonstrated publication-order blocker before final-tag promotion, with focused regression coverage.
• Pass the relevant local checks and structured review, publish a scoped PR, and verify its exact-head checks and independent review state.
• After required independent approval and merge, dispatch Release Image from reviewed main; verify the digest, both Linux architectures, signatures/attestations, immutable version tag, and matching GitHub Release.
• Keep rollout/access issues open until their distinct live deployment or access acceptance criteria are met.

Refs #149, #150, #151, #117. A source PR alone does not complete this release issue.