Document release rollback and incident response

[ocularminds]

Context

Marketplace and image publication steps are documented, but maintainers lack one cross-component procedure for a bad CLI, Feature, extension, MCP, or authority release.

Scope

Add an operator runbook covering containment, immutable artifacts, mutable tags, user communication, and follow-up evidence.

Acceptance criteria

• The runbook defines immediate containment steps for each published artifact type.
• It distinguishes immutable version tags from mutable convenience tags.
• It explains how to preserve logs, digests, attestations, and checksums for investigation.
• It includes communication and replacement-release steps without recommending history rewrites.
• All commands and settings are verified against the current unified actions.yml workflow.