feat(release): certify prepare-only musl artifacts - #1854

Linked Issue

Related to #1817. This PR does not close the release tracking issue or parked Windows issue #1818.

Summary

Successor on frozen parent dc9ad36f. Extend the existing protected-main Release workflow_dispatch path with a musl prepare-only set that builds and certifies the two Linux musl archives from exact packaged bytes. Darwin prepare-only remains the default prepare set. Native FSKit certification and GitHub release publication stay skipped in prepare-only mode.

This successor provisions pinned b3sum 1.8.5 for both the musl certification job and candidate-owned Check/test execution through scripts/ci/setup_musl_certification.sh. The helper installs that exact crate with --locked, verifies the known empty vector, and keeps product builds out of certification. Homemade or embedded BLAKE3 implementations are not used. .github/workflows/ci.yml is untouched.

This does not tag, publish, promote, bump versions, first-publish a Windows runtime archive, or dispatch prepare-only / musl certification.

Changes

• workflow_dispatch keeps prepare_only and optional prepare_set (darwin | musl, default darwin).
• prepare_only=true with unset/darwin continues to build only the Darwin pair.
• prepare_only=true with prepare_set=musl builds only x86_64-unknown-linux-musl and aarch64-unknown-linux-musl.
• prepare_set=musl without prepare_only=true fails closed.
• Non-prepare (tag/nightly) matrix is Darwin + GNU + musl. Windows remains out.
• musl-certification runs only for prepare-only musl, on ubuntu-latest (x86_64) and ubuntu-24.04-arm (aarch64). It downloads binary-${{ matrix.target }} from the same run by name and does not use cross-run artifact-ids / run-id.
• The cert job installs the Rust toolchain (dtolnay/rust-toolchain@29eef336, 1.95.0) and runs scripts/ci/setup_musl_certification.sh so pinned b3sum 1.8.5 exists before archive certification. It does not rebuild product binaries (cargo build, cargo check, cargo test, -p astrid, or CARGO_TARGET_DIR are forbidden in that job).
• fskit-certification and github-release remain skipped when prepare_only is true.
• scripts/certify_musl_release_archive.sh requires executable members astrid, astrid-daemon, astrid-build, astrid-emit, and astrid-storage-provider-fuse; staged identity is the basename. It fail-closes unless b3sum reports exactly version 1.8.5, the known empty vector af1349b9f5f9a1a6a0404dea36dcc9499bcb25c9adc112b7cc9a93cae41f3262 matches, and staged bytes agree with the downloaded artifact via pinned b3sum and system sha256sum. Runtime b3sum invocations do not pass --locked.
• Check/test execution provisions the same real 1.8.5 binary through scripts/ci/setup_musl_certification.sh --b3sum-only without editing ci.yml.
• Musl images remain the existing official Rust 1.95.0 Alpine pins.
• .github/workflows/release.yml stays at 995 lines (SRC_CAP=1000).

Verification

• Exact head 72690a08f2cc740cdc4a245c987a907cbcb47233. Sole parent dc9ad36f8cebd937cf0ed15c3f3a87235fd56b17. Tree f6f4b97b8f2450f5ead8921eb066c1666570202d.
• origin/main c057ff02d2f91a81dc0fc7f61d921cd2edf114c4 is an ancestor. Rejected unpublished fb781397855f6b27797dd083842da0a4db538c1e is not parent, ancestor, or cherry-pick.
• Unique files versus parent:
  • .github/workflows/release.yml
  • scripts/ci/setup_musl_certification.sh
  • scripts/test_certify_musl_release_archive_contract.sh
• Unique files versus origin/main also include:
  • scripts/certify_musl_release_archive.sh
  • scripts/ci/test-release-contracts.sh
  • scripts/classify_release_build_matrix.py
  • scripts/test_channel_workflow_contract.sh
• GPG Good key 7CD32E7697286B11593246B9FA53358CB4127512; matching DCO present.
• Local: classifier 16-case matrix; scripts/test_channel_workflow_contract.sh; scripts/test_certify_musl_release_archive_contract.sh; scripts/ci/test-release-contracts.sh.
• git diff --check clean; release.yml is 995 lines; ci.yml is unchanged.

Residuals and claim limits

• Source/workflow contract only. Do not dispatch prepare-only Darwin or musl certification from this PR.
• Predecessor exact-head verdicts on dc9ad36f do not transfer.
• Does not produce or recover a Darwin binary-<triple> for native FSKit certification.
• Does not land musl as a published 2026.9.0 inventory claim until certification later succeeds on landed main.
• Does not implement a Windows daemon, merge draft Add Windows x86_64 release archive certification #1814, or restore Windows runtime archives.
• Does not bump, tag, publish, or close Release Astrid Runtime 2026.9.0 #1817 / Certify native Windows runtime daemon and exact archive install lifecycle #1818.

AI / Tool Assistance

Assisted-by: Codex:zai-coding-responses/glm-5.3-flash

The prepare-only musl certification lane and this b3sum-provision successor were authored with Codex assistance in an isolated worktree. Exact SHA, unique file set, ancestry, signature, DCO, and local contract tests were independently verified. Independent exact-head review is required; this PR is not merge-ready on author evidence.

Checklist

• Linked to an issue
• Changelog fragment skipped for this release-guard-only change; PR is labeled skip-changelog
• I understand every change in this PR and can explain its design, risks, and validation.
• I reviewed and tested the meaningful tool-generated output included in this PR.
• Every non-bot, non-merge commit has a matching Signed-off-by trailer.