Prepare native Runtime Pack publication

[Open-Squilla]

Scope

• move all 14 Python, Node.js, and Git Bash packs to reviewed GitHub-hosted native runners
• freeze catalog 2026-08-21.1 with Python 3.13.15+20260814, Node.js 24.19.0, and Git Bash 2.55.0.windows.5
• require Git Bash Authenticode verification and preserve the complete bounded license set
• create an audited Draft Release only; never publish automatically
• mirror published immutable assets into opensquilla-releases/runtime-packs/<tag>/, verify public byte equality, and record OSS Version IDs

Branch target

main

Linked issue

None

Release note

Operational release infrastructure; documented in the repository README and SECURITY policy.

Verification

• python scripts/validate_sources.py sources.json
• python -m pytest -q — 48 passed
• python -m ruff check scripts tests
• python -m py_compile scripts/*.py
• actionlint
• native local build/probe on macOS arm64 for Python and Node.js

Safety

• source URLs and SHA256 values are immutable and allowlisted
• Runtime Pack archives remain deterministic .tar.xz files with manifest, licenses, and SPDX SBOM
• the client never executes the Git for Windows SFX
• the workflow cannot publish the Draft Release
• existing OSS objects are accepted only when their downloaded SHA256 matches
• no delete or moving update-channel operation is used

Third-party origins

• CPython: astral-sh/python-build-standalone release 20260814
• Node.js: official nodejs.org release v24.19.0
• Git Bash: official Git for Windows release v2.55.0.windows.5