P1: Build a hermetic reproducible Braid publish and release path

[srinji-kaggss]

Parent roadmap: #74

Problem

Braid's crates are intended to be consumed by other repositories, but the
registry export is stale and there is no reproducible regeneration/release
path. A local sibling checkout or mutable workspace state must not be part of
the supply chain.

Scope

• Define the publishable crate set and version policy.
• Generate the registry/export from the current workspace with one repeatable
  command; fail if generated output differs from source.
• Pin dependency versions/checksums and record provenance/update procedure.
• Build and package from a clean checkout with no private sibling directories.
• Publish or produce a dry-run artifact bundle first, then cut a signed/tagged
  release only after the clean consumer probe passes.
• Include release manifest, CID/KAT results, CI evidence, and rollback notes.

Acceptance criteria

• cargo metadata --locked and package/build succeed on an empty runner.
• Registry output is regenerated from the workspace and is byte-stable.
• A scratch consumer resolves the published/tagged crates without a path
  dependency or vendored snapshot.
• Exact versions, checksums, source commits, and supported Rust version are
  documented.
• A failed publish cannot leave a partially advertised release.
• Release and rollback procedures are tested and attached as evidence.

Depends on: #73, and the final decisions from #63 where they affect published
interfaces. Related: #74, #70, #72.

[srinji-kaggss]

Release-boundary evidence landed in #93 and #94.

• Merged source: 3a89e608f50c232cbf8ef26600d662b9c3a76375.
• Post-merge main CI: run 33327718029, terminal success, including cleanup.
• Clean GitHub consumer: https://github.com/srinji-kaggss/Braid.git at the exact merged source; locked build passed, registry/capsule KATs matched, verifier returned admit.
• Registry export: 1,058 deterministic bytes; SHA-256 1fac13b0e2798ef3540052a1e9ce0468b3c0fc943d6beb472494554edc1c98e5.
• Stable contract: five crates at 0.1.0, Rust 1.98.0, exact transitive checksums in release/consumer-probe/Cargo.lock.in.
• The probe was observed failing twice before it was accepted: first on a fallible web-registry API assumption, then on the real GitHub transport. Both defects are now gated. CI also treats shell/workflow changes as code, preventing a release-script fix from skipping its own lane.

This issue remains open. No tag or crates.io publication has been advertised. The next external mutation is the signed immutable braid-contract-v0.1.0 tag, followed by the first kernel/browser consumer PRs under #76. The tag must not be created until release authority is explicit.