chore: retire or repackage pre-v1.8.8 binary assets

[tt-a1i]

Context

Dogfooding the Apache-2.0 release boundary found that the packaging scripts before v1.8.7 copied only the binary and README. v1.8.8 is the first published release whose four binary archives include the canonical byte-identical LICENSE.

Older published binary assets remain downloadable and should not be silently mutated or deleted without an explicit retention decision.

Decision needed

Choose one auditable policy for published releases before v1.8.8:

1. retire compiled assets and retain tags/source archives plus a superseded notice; or
2. reproducibly repackage each exact tagged binary with the tag LICENSE, publish new checksums, and disclose the asset replacement.

Acceptance

• inventory every published release and asset before v1.8.8;
• preserve exact tag/source history;
• do not move tags;
• ensure no downloadable compiled archive lacks the applicable license;
• record old/new checksums and all external mutations;
• keep v1.8.7 documented as an unpublished RC tag.

[tt-a1i]

Full published-asset audit (2026-08-23)

A read-only download and inspection covered every published Release and every attached artifact.

Evidence

• 22 published Releases from v1.0.0 through v1.8.8 (v1.8.7 is an unpublished tag only).
• 88 compiled archives and 88 adjacent .sha256 files downloaded anonymously.
• 88/88 archive checksums pass.
• v1.8.8: 4/4 archives include LICENSE; all four bytes equal the tag blob (SHA-256 c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4).
• v1.8.5 and v1.8.6: their tag trees contain Apache-2.0 LICENSE, but 0/8 compiled archives include it.
• v1.0.0 through v1.8.4: 0/76 compiled archives include LICENSE, and those tag trees also contain no LICENSE file. The license was introduced at commit 52cb60146f3396cf1449850ff01ae62c3f2acf79.

This means the original issue description was too narrow: most historical versions cannot be repackaged with a license taken from the exact tag because none exists in those tag trees.

Recommendation

Prefer the retirement policy for all compiled assets before v1.8.8:

1. preserve every immutable tag, source archive, and Release record;
2. remove only the attached compiled archives and their checksum files;
3. add a prominent superseded notice to each affected Release pointing to v1.8.8 or later;
4. disclose the exact removed asset names and keep this issue as the audit trail.

This avoids rewriting historical binaries/checksums or implying that a post-tag license was originally present. No Release asset was changed during this audit; destructive remediation still requires an explicit decision.

[tt-a1i]

Part of #255 first-value program.

Blocked by #258 so superseded notices can point to verified v1.8.29.

This remains the source-of-truth issue; no duplicate ticket was created.

[tt-a1i]

Read-only inventory and backup are complete for this hardening round:

• 21 published releases from v1.0.0 through v1.8.6, 8 attachments each:
  84 binary archives and 84 adjacent checksum files, 168 attachments total.
• All 168 attachments were downloaded to a dedicated local backup. Archive
  hashes matched their adjacent checksums; sizes and available GitHub digests
  were verified. Archive listing, without executing binaries, found no LICENSE
  in any of the 84 archives.
• Exact tag objects and source commit mappings were captured for those releases
  and v1.8.7. v1.8.7 remains an unpublished RC tag.
• Original release metadata/bodies and asset IDs were retained for an auditable
  disposition. Backup inventory SHA-256:
  4bb993760421e0ada4ea492543a37ef1261590b4043f4a8f2ff2c365e8b6543e.

No release, tag, or attachment was modified or deleted. The retire-versus-repackage
decision remains pending; this issue must stay open. Retiring the exact backed-up
attachments would break their old binary-download URLs while keeping tag/source
history and release records. Repackaging would instead change artifact checksums.
Neither policy is implied by the completed audit or PR #373.

[tt-a1i]

Release-scope clarification: the maintainer agreed to handle historical-asset cleanup separately from the new release. v1.8.45 is now public at https://github.com/tt-a1i/skillroster/releases/tag/v1.8.45, with all four archives including the source-identical LICENSE and README and eight verified public attachments. This does not resolve the historical inventory in this issue.

No pre-v1.8.8 attachment, tag, source archive or Release record was deleted or replaced. Keep this issue open for its own explicit retire-versus-repackage decision and acceptance. The existing inventory/backup evidence remains an audit record, not authorization to mutate historical assets.