feat: add tagged release automation with fail-closed release gate (Phase 19)

[mattpartida]

Summary

Implements roadmap Phase 19: Tagged release automation and attestations — the next unclaimed planned phase (Phases 1–18 shipped; open PRs #7–#10 cover different areas; #10 covers Phase 20).

• scripts/verify_release_gate.py — dependency-light, fail-closed pre-release gate. Verifies: stable vX.Y.Z tag shape; tag→commit binding with annotated-tag peeling (workflow GITHUB_SHA may be a tag object); a ## X.Y.Z section in CHANGELOG.md ordered above older releases; exact dist/ inventory (agent-security.skill, healthcheck.skill, MANIFEST.json); manifest structure; per-archive SHA-256 vs manifest; secret-shaped content scan over archive bytes (GitHub/AWS/Slack/private-key/Google-API-key patterns, label-only reporting, never echoes matches); and the Phase 18 deterministic rebuild (package_skills.py --check). Exits 0/1/2 (pass/gate-failure/usage). Never mutates repo, dist, or remote state.
• .github/workflows/release.yml — triggers only on v*.*.* tag pushes. Job-scoped permissions: contents: write, attestations: write, id-token: write; workflow-level default permissions: {}; persist-credentials: false; node24 majors (checkout@v7, setup-python@v7) consistent with PR chore: upgrade first-party actions to node24 majors #9. Runs the full CI quality gate (ruff/compileall/pytest), rebuilds archives deterministically, runs the release gate with GITHUB_REF_NAME/GITHUB_SHA, attests build provenance via actions/attest-build-provenance@v4 (current major, v4.2.2), then publishes with gh release create --verify-tag (first-party CLI, no third-party release action) uploading both .skill archives and MANIFEST.json. Any step failure → no release created. Pull requests never receive release permissions from this workflow.
• Docs — new docs/release-automation.md (workflow steps, gate semantics, maintainer release flow, retry path via delete/re-tag); links from docs/installation-and-release.md; roadmap Phase 19 → Shipped with scope/acceptance criteria; CHANGELOG entries.
• Tests — tests/test_phase19_release_gate.py, 13 tests: tag shape, changelog section detection + ordering, inventory/manifest/digest failure modes, secret-scan reporting without echoing, annotated vs lightweight tag binding (temp git repos), packager-check drift detection, end-to-end gate pass (rc 0) and blocked runs (rc 1), workflow least-privilege shape assertions.

No scanner behavior, JSON fields, or skill behavior changes — CLI additions only. Fully backwards compatible.

Test Plan

Local (Python 3.11.13, matching CI):

• python -m compileall -q skills tests scripts — OK
• python -m pytest -q — 142 passed (129 pre-existing + 13 new)
• ruff check . — All checks passed
• ./package-skills.sh + python scripts/package_skills.py --check — reproducible, no drift
• git diff --check — clean
• CLI smoke: no-args → usage exit 2; unknown tag/missing changelog → gate failures, exit 1
• No real secrets committed; secret-pattern scan over repo content clean

CI will run the same gates on this PR.

Notes

• The existing remote tag v0.1.0 (annotated, no GitHub release attached) predates this workflow; it will not trigger it. First use: move Unreleased changelog entries into a ## 0.2.0 section, tag, push — the workflow verifies and publishes.
• gh release create avoids adding softprops/action-gh-release as a third-party dependency; PR chore: upgrade first-party actions to node24 majors #9's action allowlist (which only guards ci.yml + examples/) is unaffected, and versions stay consistent with it.
• Out of scope / next: Phase 20 (report authenticity envelopes) already has PR feat: add HMAC-SHA256 report authenticity envelopes (Phase 20 JSON slice) #10 open.