[joe-broadhead]

The release kit for the CI-built release (design B), revision 4e6cf28: the kit opencode-gws v0.0.1 was released with (9f3168a, gws PR #34), plus gws PR #36, which only builds the kit test's path fixtures at run time so the family's check-forbidden passes. A release no longer needs anyone's laptop or signing key.

What it does:

• Dispatched by hand on master with the sha CI passed (and, for a native plugin, the native.yml run id): gh workflow run release.yml --ref master -f sha=<sha> [-f native_run=<id>]. The tag-push trigger is gone.
• Refuses before anything is written: a run off master, a sha that is not master's head, no green ci.yml push run on it, a version or CHANGELOG not ready, a release that does not move forward from the published Releases, a leftover release/v<version> branch, a wrong native run or manifest.
• Builds with no write token. Jobs that run repository or dependency code have contents: read only; jobs that use the API run only the kit's scripts on a fresh checkout, after checking that scripts/ and .github/ are the parent's.
• GitHub-signed release commit on a temporary release/v<version> branch, made through createCommitOnBranch with the workflow token (author github-actions[bot], verified); its tree is checked against the files.
• Checks and packing before the release approval: identity, one parent on master, exact package.json, allowed paths, a byte-for-byte independent rebuild, plugin add on every tested host, the pack stage, attested native files, SHA256SUMS and notes, shown in the run summary with the sha256 of SHA256SUMS.
• Tag and Release only after approval: publish downloads the staged artifact by id, refuses unless SHA256SUMS has the approved digest (and native files match the release commit's manifest), then creates the tag and the Release.
• The kit makes only its own GitHub calls (an allowlist): never deployment approval, environments, rulesets or branch protection.

Also: scripts/check-icons.mjs revision 2 (backward compatible; the vendor-mark mode is opt-in).

This PR changes only kit files: the release scripts and their tests, .github/workflows/release.yml, CONTRIBUTING's Releasing section and the test:kit script line. It passed two independent reviews and a scratch-repo rehearsal, and shipped gws v0.0.1.

Repository setting (the lead does this, not this PR): the release environment's deployment policy moves from tag v* to branch master.