Publish a versioned wheel deployment bundle

[cbeaulieu-gt]

Summary

Publish a versioned, verifiable deployment bundle that lets external infrastructure install the exact Harness wheel and dependency set without retaining a Harness Git checkout.

Bundle contract

The bundle contains the Harness wheel, a runtime-only lock export, checksums, installation instructions, and the non-authoritative deployment examples classified by #383. It is generated from one exact source revision and treated as one release unit.

Acceptance criteria

• CI builds the wheel from clean source using the lock established by Establish a frozen wheel installation foundation and dependency lock #360.
• Export an installable runtime-only lock artifact without re-resolving dependency versions.
• Generate checksums covering every bundle artifact.
• Include installation instructions that create an isolated environment, synchronize locked dependencies, and install the wheel without dependency resolution.
• Include the example assets delivered by Reclassify infrastructure scripts as non-authoritative examples #383 without making them authoritative deployment policy.
• A bundle-only test installs and exercises the packaged commands without a Harness checkout or .git.
• Artifact metadata and Expose machine-readable runtime provenance and non-mutating preflight results #358 provenance agree on package version, source revision, and dependency-lock identity.
• Publication fails closed when an expected artifact, checksum, lock export, or provenance field is missing or inconsistent.
• README documents how deployment consumers obtain and verify the bundle.

Dependencies

Depends on #360, #358, #378, #379, #380, #381, and #383.

Out of scope

Publishing to PyPI, installing systemd, choosing host paths/users, credential enrollment, activation, and rollback.

Parent: #361

🤖 Generated by Codex on behalf of @cbeaulieu-gt