Prepare v0.2.3 with verified image promotion and runner 2.337.0

[jmcte]

Summary

Prepare the existing v0.2.3 release target with Actions Runner 2.337.0 and repair failure paths exposed by the previous release attempt. Publication now requires confirmed absence, uses a unique candidate per attempt, checks both Linux runtimes by immutable digest before promotion, and recovers incomplete releases only when signed provenance matches the source commit. Bounded signing retries preserve diagnostics.

The built CLI now includes its canonical runner-version metadata. The audit rotation regression uses eight synchronized lightweight processes, retaining real disk writes and rotation while avoiding repeated full-CLI startup.

Governing Issue

Refs #229, #149, #150, #151. These issues remain open for successful release publication and their separate live rollout requirements.

Validation

• pnpm lint passed.
• pnpm test:coverage passed: 365 tests in 56 files; all coverage thresholds passed (80.49% statements, 75.70% branches, 84.99% functions, 80.59% lines).
• pnpm build passed; compiled reader returns 2.337.0 with its packaged metadata.
• Runner freshness and release-manifest commands verified official v2.337.0 from GitHub.
• Pinned actionlint v1.7.7, ShellCheck, Node syntax, and diff checks passed.
• An independent in-session source review found no concrete bugs. Structured autoreview stopped before model invocation because its scanner treats the OCI digest reference in preflight.sh as a credential-bearing URL; the normal GitHub credential scan passed.
• Exact-head CI and independent code-owner approval remain required.
• Full mutation testing was not rerun: the existing nightly job exhausts its 30-minute budget. Actual Docker image publication remains for the reviewed main-branch release workflow.

Bootstrap Governance

• Changes are scoped to the linked release issue.
• No real secrets, runtime auth, or machine-local environment files are committed.
• Existing local work was preserved. Neither PR-template path is part of this change.
• Contributor/PR guidance is unchanged.

Merge Automation

Auto-merge is enabled at commit 1a4c387. Required checks and independent approval must remain satisfied; no administrative bypass is requested.

Notes

• This PR does not publish a release or change any running pool. It prepares a reviewable release candidate.
• The latest GitHub Release remains v0.1.11. Live registry checks found no 0.2.3 or 0.2.2 final tag; existing 0.2.1 is preserved.
• Two additional changes await explicit permission and are excluded: clear the stale runner override in the protected example environment, and grant the standalone reusable-release smoke caller the permissions requested by its callee. The existing main CI caller already declares those permissions.
• Nightly governance inspection has a separate HTTP 403 after its managed-file plan passes. PR chore: reconcile Bootstrap manifest contract #211 and open dependency updates are outside this release patch.
• Local Sigstore login timed out. This commit was authored with GitHub's signed-commit API and verified as signed by GitHub; local signing settings were not altered.