fix(release): verify public-native promotion evidence

[rldyourmnd]

Summary

Replace the private-era promotion payload with nddev-public-release-promotion/v2. A GitHub-verified annotated tag now binds the exact public commit to three fresh public roles: CI, contract, and security. No private repository identity, root commit, registry digest, or private token is required.

The repository now ships scripts/render-public-promotion-record.sh, which validates identities/URLs/digests and emits canonical compact sorted JSON ready for signed tag annotation.

Permissions diff

None. The reusable gate remains permissions: {} at top level and contents: read for the verification job.

Threat model

• unsigned/lightweight/wrong-commit tags fail closed;
• missing, duplicate, failed, stale, cross-repository, or malformed public evidence fails closed;
• canonical serialization is signed and revalidated from GitHub’s verified payload;
• human authorization remains a separate protected release environment;
• public verification needs no private read capability.

Verification

• core validate_all.py
• executable positive/negative promotion fixtures
• actionlint
• pinned zizmor 1.26.1 with authenticated online audits
• shellcheck / renderer canonical-output probe