feat(release): Add Stable backport train governance

[leumor]

Summary

• add the canonical side-effect-free stable-backport command with evaluate, prepare-candidate, validate-authorization, and verify-release-completion modes
• define the versioned Stable 1.0 fix-classification, disposition, state-transition, provenance, queue, authorization, redaction, no-fork, and reconciliation contracts in strict checked-in policy and schemas
• authenticate full Git commit identities, branch bases, ancestry, patch provenance, candidate coverage, protected reviewer approvals, and post-publication no-ff reconciliation without mutating Git or remote state
• require exact release-train evidence throughout Stable maintenance validation and publication, lifecycle pending transitions, successor baselines, history, release notes, checksums, and provenance
• add protected read-only workflows with encrypted authoritative handoffs and bounded public queue/validation projections
• document the single-chain maintenance/hotfix workflow and update the repository Git, release, hotfix, interop-gate, and release-note skills

Security and release boundaries

• preserves the single authenticated Stable 1.0 latest-pointer chain; historical builds remain upgrade/recovery coverage sources, not mutable patch branches
• keeps publication authority in the existing Stable maintenance workflow and train-composition authority in a separate exact, expiring authorization
• rejects abbreviated or symbolic Git identities, wrong branch bases, unaccounted candidate changes, patch-id-only authorization, unresolved critical obligations, stale evidence, plaintext protected handoffs, and embargo leakage
• performs no cherry-pick, merge, push, tag, GitHub Release, catalog publication, update insertion, or other publication side effect during ordinary validation and self-tests

How to test

• ./gradlew spotlessApply
• python3 tools/release-certification/certify.py stable-backport --self-test — 119 tests
• python3 tools/release-certification/certify.py stable-maintenance --self-test — 203 tests
• python3 tools/release-certification/certify.py stable-lifecycle --self-test — 120 tests
• python3 tools/release-certification/certify.py stable-ga --self-test — 71 tests
• python3 tools/release-certification/certify.py stable-rc --self-test — 50 tests
• python3 tools/release-certification/certify.py self-test core — 113 tests
• python3 tools/release-certification/certify.py self-test all — 703 tests
• compile all changed Python files with python3 -m py_compile
• parse all changed JSON and YAML, run actionlint on the changed workflows, and run git diff --check

All listed checks pass. No Java runtime or Gradle build-logic files are changed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c55bea9c78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud