[andersalm]

Part of #89

One release path in place of the never-merged #232 path (4,255 lines of workflows, capacity script and runbook).

What changes

• .github/workflows/release-package.yml (manual run): source commit, install version N, update version N+1, and seed_package (default false). It builds the Apple silicon pair (N+1 reuses N's support) with no keys and no model inputs. The Linux seed package (Runtime N, ipfs-provider and its exact source) is built only when seed_package is set.
• scripts/release-publish.sh:
  • prepare: downloads and checks the Mac artifact, then prepares unsigned input in an isolated data dir with Kubo from the build.
  • policy: writes the exact signer policy with the current develop head.
  • seed: prints the per-release import with the seed's installed Runtime. Copy 4 signed files and sums, rebuild the rest from the artifact, verify, stop, preflight, import (accepting only the known post-commit gossip error), start. It touches no source root.
  • seed-upgrade (rare): prints the seed Runtime upgrade. Create /opt/elastos for the service user before the stop, check and install the source, install the Runtime and provider, update the provider pin in components.json, verify the provider, start.
  • Seed host, data dir, unit, staging dir, Runtime path and service user all come from env.
• docs/VERSIONING.md: new "Publishing a release" section. It replaces "Ceremony Requirements".
• .github/scripts/release-mac-capacity.py and its test, run in CI next to the other release tests.
• canary-holder-linux.yml: no longer triggers on fix/89-canary-inputs. Per the operator decision it builds the Runtime and providers from the PR source instead of admitting the pinned 0.8.0-alpha.1 artifact (that artifact expires on 10 Oct). The frozen helper tree, observer pin and unused packaging steps are gone. scripts/holder-idle-ci.py follows.

Checks kept: exact source and tree, on develop or an open same-repo PR head that contains develop, fresh Cargo dirs, N/N+1 version, source and support parity, artifact digests (checked again by prepare and on the seed), and every input and signed file hash.

Dropped from #232, and why:

• PR feat(release): deliver licensed software and models through signed Carrier capsules #230 pins and the admission artifact relay: job outputs carry the admitted tree.
• Helper-approval comment hash: the seed source root is now a fixed, neutral constant (/opt/elastos/release-source) in this reviewed workflow. Reviewing the workflow approves the root just as well, and no seed username ends up in the repo.
• The release_publication:: cargo test rerun in the seed job: CI already runs it, and the signer refuses any commit that is not on develop.
• The split-archive self-verification code: tar | gzip | split with SHA256SUMS on both sides does the same job.

Net lines: +887 / -451 = +436 against develop, and -3819 against the #232 path it replaces.

Local checks: YAML parses, bash -n passes for the script, every workflow run block and both printed seed sequences, the capacity test passes (14 tests), pyflakes is clean, and smoke runs of policy, seed, seed-upgrade and prepare (up to the git fetch) used a stubbed gh.

Open risks: the release workflow has not been dispatched yet, so the first real run is its proof. The holder workflow on this PR is the proof for the holder change.