docs: treat release manifest as generated asset

Author: a-a-k

.gitignore

@@ -1,6 +1,7 @@
 # Binaries
 bin/
 dist/
+release-manifest.json
 *.exe
 *.dll
 *.so

README.md

@@ -5,7 +5,7 @@
 [![ci-template-smoke](https://img.shields.io/github/actions/workflow/status/MB3R-Lab/Sheaft/ci-template-smoke.yml?branch=main&label=ci-template-smoke)](https://github.com/MB3R-Lab/Sheaft/actions/workflows/ci-template-smoke.yml)
 [![schema-contract](https://img.shields.io/github/actions/workflow/status/MB3R-Lab/Sheaft/schema-contract.yml?branch=main&label=schema-contract)](https://github.com/MB3R-Lab/Sheaft/actions/workflows/schema-contract.yml)
 [![Go version](https://img.shields.io/github/go-mod/go-version/MB3R-Lab/Sheaft)](https://github.com/MB3R-Lab/Sheaft/blob/main/go.mod)
-[![Status](https://img.shields.io/badge/status-technical_preview-orange)](https://github.com/MB3R-Lab/Sheaft/releases/tag/v0.2.2)
+[![Technical preview](https://img.shields.io/badge/preview-v0.2.2-orange)](https://github.com/MB3R-Lab/Sheaft/releases/tag/v0.2.2)
 [![Bering support](https://img.shields.io/badge/Bering-1.0%20%7C%201.1-blue)](https://github.com/MB3R-Lab/Sheaft/blob/main/docs/compatibility-matrix.md)
 
 Sheaft is a downstream resilience posture engine and CI/CD gate for model artifacts produced by Bering or another compatible upstream producer.

RELEASING.md

@@ -10,6 +10,8 @@ The canonical release contract is the generated payload:
 
 GitHub Releases publish that payload, but GitHub metadata is not the source of truth.
 
+`compatibility-manifest.json` is intentionally checked in because it mirrors the current strict upstream contract pins and is drift-checked in CI. `release-manifest.json` is release-specific and must not be committed from `main`; it is generated during `make release-dry-run`, `make release-local`, and tag-driven release publishing, then uploaded as a release asset.
+
 ## Ownership Boundary
 
 - Bering owns upstream artifact schemas and release metadata.

VERSIONING.md

@@ -6,7 +6,7 @@ Sheaft has multiple version surfaces. They are related, but they are not interch
 
 - Format: `X.Y.Z`
 - Source of truth for tagged releases: Git tag `vX.Y.Z`
-- Stored in `release-manifest.json` as `app_version`
+- Stored in the generated release asset `release-manifest.json` as `app_version`
 - Controls binary archive names, chart packaging version override, and image release tags
 
 ## 2. Upstream Contract Compatibility
@@ -31,7 +31,7 @@ This is compatibility metadata, not ownership metadata.
 - Format: `X.Y.Z`
 - Published as an OCI chart, not through a classic Helm repository
 - Defaults to the app version for a tagged release
-- Recorded in `release-manifest.json` under `chart.version`
+- Recorded in the generated release asset `release-manifest.json` under `chart.version`
 
 ## 4. Sheaft-Owned Config and Overlay Schemas
 

docs/install.md

@@ -2,7 +2,7 @@
 
 The current public technical preview is `v0.2.2`. Prefer release assets for evaluation and automation; use `go install` or `go build` as fallback paths.
 
-The machine-readable entrypoint for release consumers is `release-manifest.json`. It records exact archive names, checksums, image references, chart version, and the default config pack asset for a given release.
+The machine-readable entrypoint for release consumers is the `release-manifest.json` asset attached to each GitHub Release. It records exact archive names, checksums, image references, chart version, and the default config pack asset for that release.
 
 ## Preferred: Release Binary + Default Config Pack
 

docs/release-assets.md

@@ -6,11 +6,11 @@ The canonical files are:
 
 - `dist/`
 - `compatibility-manifest.json`
-- `release-manifest.json`
+- `release-manifest.json` as a generated release asset, not a committed `main`-branch file
 
 ## Asset Inventory
 
-`release-manifest.json` describes:
+The release asset `release-manifest.json` describes:
 
 - product name
 - app version