fix: wire self-hosted release entrypoints

[Lucenx9]

Summary

Wires the missing stable package entrypoints for the SkillWire Self-Hosted v0.2.0 release contract while preserving the signed-production trust boundary.

Public commands

• pnpm build:self-hosted <payload-root> <output-directory> <amd64|arm64> maps directly to the reviewed deterministic archive/manifest builder. It emits only the unsigned canonical payload and never signs or publishes.
• pnpm verify:self-hosted --manifest ... --bundle ... --archive ... --policy ... --trusted-root ... --cosign ... --architecture ... maps directly to the complete published-release verifier. It requires canonical manifest bytes, Sigstore Bundle v0.3 evidence, policy-pinned TrustedRoot/Cosign, exact signer claims, archive identity and safe extraction, payload inventory, digest-pinned images, Compose policy, catalog/advisory integrity, and Feature 003 package integrity.

The protected release workflow and normative quickstart, release/recovery contract, and distribution README now use these same entrypoints. There is no local signing, ambient credential use, unsigned production installation, trust bypass, or mutable online verification dependency.

Validation

• Node.js 24.18.0 and pnpm 11.21.0
• Regression-first entrypoint contract: 6 tests passed
• Release reproducibility and workflow security: 76 tests passed
• Feature 004 aggregate: 406 passed, 8 expected environment-gated skips
• All 28 acceptance scenarios mapped and executable
• Full PostgreSQL 17.10-backed offline suite: 904 passed, 9 expected environment-gated skips
• Feature 003 activation: 98 passed
• Feature 003 adapter: 65 passed; package identity remains 0.1.1 / f4e2e1cca7b4c99d41d585d2816b44b4203297ad15809e3c1b87bedb8b6e805e
• Catalog and advisory integrity passed
• Formatting, ESLint, strict TypeScript, build, Actionlint, all three Compose renderings, credential/artifact/wrapper scans, and git diff --check passed
• Exact-patch Codex Security diff scan: complete coverage, zero findings

Release boundary

T161 remains unchecked and pending the external immutable release ceremony. This PR does not create self-hosted-v0.2.0, a GitHub release, a signature, or a production release asset. The release workflow does not run or publish on pull-request events.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 006a0ae7c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".