fix(S030): harden release bootstrap and verify public deployments

[h8rt3rmin8r]

Pinned setup-go downloads have failed during runner preparation, before a build-step retry could run. This change acquires the existing Go/Node action revisions in bounded, SHA256-verified steps, then executes their complete upstream trees locally with the same inputs and cache post hooks. Historical candidates obtain bootstrap tooling from the defining workflow commit; matching source/workflow revisions reuse the existing checkout.

It also adds release.py verify-public and runs it after exact Pages promotion. The GET-only verifier checks the original candidate, published tag/source and full asset metadata, compares archived documentation with actual public navigation/resource URLs, and fences the Pages commit before and after live reads. Public binary API metadata proof is reported separately from downloaded documentation byte proof.

Closes #102
Closes #103

Validation: 104 root tests, 284 Python tests, 10 site tests, repository/schema/brand checks and public/offline site exports passed locally. The actual read-only CLI verified all nine original v1.0.1 assets, full published metadata and 891 live URLs covering all 813 original export files in 41.515 seconds, with exact existing Pages commit 85b1476d86a9bfe8fbaac159b4df98226bc2393a. No release/tag/deployment was changed. Spec Kit artifacts and evidence: specs/030-release-pipeline-reliability/.

Hosted Windows/Linux qualification and exact-head CI remain required. Limits: three acquisition attempts/60 seconds per action; 120-second public content phase. Checkout/other action preparation still depends on GitHub. Archive compression changes require reviewed lock refresh; the lock needs explicit maintenance outside normal Dependabot action discovery.

Owner final review and squash merge follow green CI and resolved reviews. No new product release is requested by this PR.

Final-round findings addressed in 0aeded2: include all original export files and resolved CSS/font dependencies, and bound DNS/connection/TLS/body work through a parent-owned hidden network worker (one four-thread worker per public batch). Both inline findings have replies and are resolved. No further review request will be made; final-head CI remains the delivery gate.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T11:52:56.481120Z	1404e48	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[h8rt3rmin8r]

Second and final authorized review round (2 of 2). The opening review completed clean with a bot thumbs-up and zero inline threads. The latest commit adds an owned-connection deadline watchdog plus a failing-then-passing stalled-header regression; all 279 Python tests and the complete read-only live verifier pass (9 original assets, 290 live URLs/212 files, exact existing Pages commit). Please review the current head for code and security findings. No further review round will be triggered.

@codex review
@codex security review

[h8rt3rmin8r]

Security portion of the same final review round (2 of 2), for head 1404e4853fabf0d5c24886883c5dea3d9a047f24. The combined command above started the code review only; this separate command requests its security counterpart on the same head. No third review round is authorized or requested.

@codex security review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1404e4853f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[h8rt3rmin8r]

S030 is ready for owner final review and squash merge.

Final head: 0aeded2bd72a169da908014ddaddc570574a2e68.

• Final CI: success; 18 elected jobs passed, 14 expected skips; no pending or failing check runs on the final head. Workflow duration 657 seconds (653 seconds from first job start to last job completion), within the 660-second budget.
• Both final-round P2 findings are fixed, tested, replied to and resolved. Direct thread audit: 2 resolved, 0 unresolved. No further review request was made.
• Local parity: 104 root tests, 284 Python tests, 10 site tests, complete public/offline exports, repository/schema/brand checks and text integrity.
• Actual read-only verifier: all 9 original release assets, complete public metadata, 891 live URLs covering all 813 original export files, including CSS imports and WOFF2 fonts; exact existing Pages commit checked before and after requests. Content phase 41.515 seconds. Both pinned action acquisitions also passed through the final parent-bounded headless worker.

Issues #102/#103 acceptance is checked and their Project state remains In review until merge. This comment records final Spec Kit delivery task T013 acceptance after publication, avoiding an evidence-only commit and another CI run. The checkout is clean and synchronized. No release, tag or site deployment was changed. PR checks do not establish the later squash commit's main-branch CI; that must be verified after merge.