Reconcile main with production and add main-only release automation

.dockerignore

@@ -0,0 +1,5 @@
+.git
+.env*
+target
+docs
+*.db*

.github/workflows/audit.yml

@@ -1,32 +1,19 @@
-name: Security Audit
-
+name: Security and regression checks
 on:
   push:
-    branches: [main]
   pull_request:
   schedule:
     - cron: '0 6 * * 1'
-
 jobs:
-  cargo-audit:
+  verify:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
       - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test --locked
       - run: cargo install cargo-audit --locked
-      # --deny unmaintained,unsound but NOT yanked:
-      #   core2 is yanked but all zcash crates depend on it — upstream issue.
-      #   Track: https://github.com/zcash/corez
-      # RUSTSEC-2023-0071: Marvin Attack on rsa (transitive, no direct exposure)
-      # RUSTSEC-2023-0089: atomic-polyfill unmaintained — lockfile-only via zakura-* (heapless 0.7), not compiled
-      # RUSTSEC-2026-0097: (previous advisory, retained for safety)
-      # RUSTSEC-2026-0105: core2 unmaintained — zcash upstream dependency
-      # RUSTSEC-2026-0173: proc-macro-error2 unmaintained — transitive via getset (orchard/zcash_primitives)
-      - run: >-
-          cargo audit
-          --deny unmaintained --deny unsound
-          --ignore RUSTSEC-2023-0071
-          --ignore RUSTSEC-2023-0089
-          --ignore RUSTSEC-2026-0097
-          --ignore RUSTSEC-2026-0105
-          --ignore RUSTSEC-2026-0173
+      # Neither package is compiled for our supported server targets. SQLx keeps
+      # optional MySQL RSA dependencies in Cargo.lock; atomic-polyfill is for
+      # embedded AVR/ARM targets. Assert the deployment graph before exempting.
+      - run: python3 scripts/check-dependency-exposure.py
+      - run: cargo audit --deny unmaintained --deny unsound --ignore RUSTSEC-2023-0071 --ignore RUSTSEC-2023-0089

.github/workflows/docker.yml

@@ -0,0 +1,19 @@
+name: Self-hosted image verification
+on: [push, pull_request]
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          load: true
+          tags: cipherpay:audit
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Verify non-root startup and SQLite migrations
+        run: >-
+          docker run --rm --entrypoint sh cipherpay:audit -c
+          'test "$(id -u)" = 10001 && DATABASE_URL=sqlite:/data/check.db cipherpay --check-database'

.github/workflows/release-build.yml

@@ -0,0 +1,51 @@
+name: Release Build
+
+# Builds the production binary for every commit on main, so the server never
+# compiles (1 vCPU / 1 GB) and every deployed binary maps to a clean main commit.
+# scripts/release/stage.sh downloads these assets by commit SHA.
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-build-${{ github.sha }}
+
+jobs:
+  build:
+    # Matches the CipherPay hosts (Ubuntu 24.04, glibc 2.39, OpenSSL 3).
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test --locked
+      - run: cargo build --release --locked
+      - name: Package
+        run: |
+          mkdir -p dist
+          cp target/release/cipherpay dist/cipherpay-linux-x86_64
+          git archive --format=tar.gz -o dist/source.tar.gz "$GITHUB_SHA"
+          cat > dist/build-info.json <<EOF
+          {
+            "source_head": "$GITHUB_SHA",
+            "ref": "$GITHUB_REF",
+            "dirty": false,
+            "rustc": "$(rustc --version)",
+            "runner": "ubuntu-24.04",
+            "run_url": "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID",
+            "built_at": "$(date -u +%FT%TZ)"
+          }
+          EOF
+          (cd dist && sha256sum cipherpay-linux-x86_64 source.tar.gz build-info.json > SHA256SUMS)
+      - name: Publish build-<sha> release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="build-$GITHUB_SHA"
+          gh release create "$tag" dist/* --target "$GITHUB_SHA" --prerelease \
+            --title "Build ${GITHUB_SHA::7}" \
+            --notes "Production build of $GITHUB_SHA from main. Deploy with scripts/release/stage.sh $GITHUB_SHA."

.gitignore

@@ -12,3 +12,9 @@
 
 # Internal docs (referral program, strategy)
 docs/REFERRAL-*
+
+# Referral source is public; it is switched off in production via REFERRALS_ENABLED.
+# Override global *REFERRAL* excludes so it is always committed.
+!src/referrals.rs
+!src/referrals/
+!src/referrals/**