fix(resources): stage immutable releases before promotion

[Jeremy1844]

DO NOT MERGE — provider binding, protected staging, consumer compatibility, content-rights approval, and rollback validation are unverified.

Audit root

• Audit ID: ADV-2026-0053 / RC-0053
• Base: 9d237dd4fb37dd1fb936e3f9649020cc43a374c8
• Red 1: 942b4008ac2df1c8e25a4333b603186e54b9ce17
• Red 2: 0f9475a874705f43663576e2856980b888896fef
• Head: 2e5bb9bee37cf7115009ba45e3b38b1f8e7318e2
• Scope: four ordered commits, one provider-neutral root, five new JavaScript/test files

Why

The current deployment model lacks a complete content-authenticated release manifest, immutable release address, and a conditional current-release pointer. Synthetic fault injection proves that recursive mutable publication can retain removed objects or expose a mixed release after interruption. This confirms an algorithmic defect; it does not allege a known production incident.

Minimal change

This draft adds a dependency-free release protocol, a strict generation-store adapter, a shadow-release orchestrator, and regression tests. It:

• validates the entire release before the first write;
• stages byte-verified objects beneath an immutable release identity;
• promotes only through a conditional, durable pointer generation with exact read-back;
• rejects ETag-only, absent, reused, or ambiguous generations;
• supports verified rollback, empty-release withdrawal, and concurrent-promoter safety;
• performs no upload, deployment, cache invalidation, credential access, or content transformation.

No workflow, dependency manifest, lockfile, existing source/content, asset, or deployment setting changes.

Regression evidence

• Protocol red: 2/24 pass and 22 expected failures before the protocol exists.
• Adapter red: 24/37 pass and 13 expected failures before the provider adapter/orchestrator exist.
• Head: 37/37 pass.
• Stability: 25/25 complete repeated runs pass; prior focused protocol and adapter suites also passed 100/100.
• Syntax: 5/5 JavaScript files pass node --check.
• Exact final tree is byte-identical to the audited local implementation: 23209e85fd8acb03add0b4ba3f6943a52cf662e0.
• git diff --check passes.

Protected objects remain unchanged:

• src tree: 7b0a5d6f56d0dae3640602b33b5efb101cef8e62
• assets tree: d564d0bc3dd917926892c55e3706cc116d5b165e
• yarn.lock: e187b5f98bb0acd58a206ec18b7a65716052fc45
• package.json: d18d3145ee6dc4846cae3c9fcc4f8cab7562c544
• .github tree: bd8b838c7f534ca63b3eaa0aa46c9c69c37da9d6

Existing PR overlap

All seven open resources PRs (#76–#82) were refreshed before publication. None changes any of this draft’s five paths, and none implements immutable release staging/promotion. This draft must remain independent; no existing PR should be closed or merged automatically.

Migration, recovery, and rollback

There is no stored-user-data or schema migration. Production adoption still requires a separately reviewed provider binding, a legacy URL/alias compatibility map, protected no-content staging, least-privilege IAM/OIDC, fault injection, consumer validation, content-rights approval, and a documented retention window for both rollback and redo descriptors.

Rollback must select a separately verified immutable release through a fresh conditional pointer generation. Never reconstruct an old release inside a mutable prefix, and never delete referenced immutable objects before the approved rollback window expires.

Required gates

1. Review the provider-neutral protocol and its generation semantics.
2. Implement a provider-specific binding without weakening generation/consistency contracts.
3. Prove false response, commit-then-timeout, concurrency, cache, promotion, and rollback behavior in protected non-production infrastructure using synthetic no-content fixtures.
4. Verify existing URL consumers and withdrawal semantics.
5. Obtain maintainer and rights-owner approval before any real content upload, withdrawal, cutover, merge, or release.

Fork Actions are intentionally disabled; no hosted run, deployment, merge, release, or protected-branch write is claimed.