[P1] Attach release evidence for stack-level runtime confidence

[a-a-k]

Context

Release assets exist, but stack-level product confidence depends on tying a release to runnable evidence, not only upstream pins and generated metadata.

Scope

Attach release evidence for chart render, generic smoke, adapter e2e, and pinned-image startup to each stack release.

Definition of Done

• Release notes or release manifest link the evidence used for the bundle status.
• Evidence identifies Kubernetes version, profile, upstream Bering and Sheaft app versions, image digests, chart versions, and contract lines.
• Candidate/verified status remains conservative until runtime evidence satisfies the documented criteria.
• Release dry-run verifies that required evidence references are present before publishing.

[a-a-k]

Partial progress update (2026-05-01): release-evidence plumbing was hardened, but this issue should stay open until evidence is attached to an actual stack release.

Completed prerequisites:

• 3665b82 fix: checksum release manifest asset - SHA256SUMS.txt now covers release-manifest.json.
• 4e04ad9 fix: avoid leaking registry token in smoke test - live smoke test no longer exposes GHCR pull tokens in process argv.

Verification:

• python scripts/tasks.py release-dry-run
• python scripts/tasks.py validate

Remaining scope: attach the release evidence bundle to the next stack release and link the generated artifacts from this issue.

[a-a-k]

Release update (2026-05-01): mb3r-stack v0.3.1 shipped release evidence artifacts, but this issue should stay open for stronger runtime-confidence evidence.

Release evidence now published:

• Release: https://github.com/MB3R-Lab/mb3r-stack/releases/tag/v0.3.1
• Workflow: https://github.com/MB3R-Lab/mb3r-stack/actions/runs/25205623771
• release-manifest.json, stack-manifest.json, compatibility-matrix.json, SHA256SUMS.txt, sbom.cdx.json, chart package, and asset pack are attached.

Remaining scope: attach a verified runtime-confidence bundle that includes the intended live profile/Kubernetes evidence, not only repository validation and package metadata.

[a-a-k]

Release evidence update on 2026-05-01: mb3r-stack v0.3.2 now pins Bering v0.3.2 and Sheaft v0.2.3. The main CI run passed repository validation, adapter e2e, pinned GHCR live kind smoke, chart packaging, asset packaging, and release dry-run: https://github.com/MB3R-Lab/mb3r-stack/actions/runs/25206473271. Published release assets are attached at https://github.com/MB3R-Lab/mb3r-stack/releases/tag/v0.3.2.

[a-a-k]

Release evidence update on 2026-05-01: after the Bering metadata patch, mb3r-stack v0.3.3 now pins Bering v0.3.3 and Sheaft v0.2.3. Main CI passed repository validation, adapter e2e, pinned GHCR live kind smoke, chart packaging, asset packaging, and release dry-run: https://github.com/MB3R-Lab/mb3r-stack/actions/runs/25207836967. Published release assets are attached at https://github.com/MB3R-Lab/mb3r-stack/releases/tag/v0.3.3.