Release v0.1.2 baseline with immutable, verified assets

[jnton]

Purpose

Publish the final hardened MDPI-specific Zotero baseline before work-level integrity features and the later coordinated rebrand.

Pre-release verification

• Confirm main CI and advanced CodeQL are green.
• Confirm package.json and built manifest both report 0.1.2.
• Confirm Zotero runtime suite passes with zero failures.
• Confirm the release commit is the intended tested commit.
• Confirm release immutability remains enabled.

Tag

Prefer a signed annotated tag created from a clean, current checkout:

git fetch origin
git switch main
git pull --ff-only
git tag -s v0.1.2 -m "MDPI Filter for Zotero v0.1.2"
git push origin v0.1.2

When signing is not configured, use an annotated tag rather than a lightweight tag:

git tag -a v0.1.2 -m "MDPI Filter for Zotero v0.1.2"
git push origin v0.1.2

Automated release acceptance

The tag-triggered workflow must:

• refuse a tag/version mismatch;
• run dependency audit and lint;
• build and validate the XPI;
• create a SHA-256 checksum;
• generate update.json with update_hash;
• attest XPI provenance;
• refuse to overwrite an existing release;
• publish immutable assets.

Post-release verification

• Download the XPI and checksum from the GitHub release and verify them independently.
• Inspect the XPI ZIP and manifest.
• Verify the attestation.
• Verify releases/latest/download/update.json resolves and references the exact released XPI/hash.
• Install in a clean supported Zotero profile and run a smoke test.
• Retain the runtime transcript and release hashes.

Promotion boundary

Do not conduct a major Zotero Forum launch under the old brand. Treat v0.1.2 as the stable MDPI-specific baseline. Promote the generalized plugin after shared taxonomy, privacy documentation, benchmark results, and rebrand clearance are complete.