feat(v2): harden durable runtime and release gates

[Tokisakix]

Summary

This draft PR delivers the unreleased OpenRath v2 runtime line, closes the actionable repository-wide review findings, records the published v2.0.0rc1 evidence, and adds fail-closed GA evidence and publication gates.

The RC is published from feedcaadb79a349aa60c034618610231d83fb131. The current PR head is not a GA authorization and must remain draft until the target-environment and owner gates below are complete.

What changed

• Added the governed durable runtime, adapter, authorization, migration, bounded I/O, observability, and deployment hardening described in the review evidence.
• Published and recorded the SHA-bound v2.0.0rc1 GitHub prerelease and public GHCR image, including anonymous digest access and provenance verification.
• Added separate RC/GA evidence contracts, exact same-SHA Gate C reports, protected-environment approval records, and verifier tests.
• Added the protected Collect v2.0.0 Gate C evidence workflow on a fixed self-hosted, linux, openrath-ga target runner. GA preparation now accepts only that workflow identity, workflow_dispatch, main, the exact source SHA, and a successful conclusion.
• Added hash-bound target evidence recording, credential-pattern scanning, traversal/symlink rejection, target-like HTTPS lifecycle load, single/split 1/2/4-worker scaling calculation, eight-hour soak acceptance, and full fault/backup/restore/rollout/rollback report builders.
• Split GA publication into three fail-closed stages: protected candidate preparation; local interactive upload of the exact wheel/sdist with a project-scoped PyPI token; protected finalization that verifies PyPI hashes before promoting OCI and creating the GitHub Release.
• Added safe rerun handling: existing PyPI, GHCR, and GitHub Release artifacts must exactly match the candidate bundle.
• Hardened checkout credentials, release caches, minimal workflow permissions, OCI attestations, repository secret scans, and evidence-bundle secret rejection.

Validation at current head (b671343)

• Ruff check and changed-file Ruff format: passed
• mypy: 166 source files, passed
• Offline/non-external matrix: 1091 passed, 22 skipped
• Gate C targeted contracts: 32 passed, 2 platform-dependent symlink tests skipped on Windows
• actionlint and pedantic zizmor for all GA workflows: passed
• JSON/YAML parsing and git diff --check: passed
• Trivy repository secret scan: passed
• Previous package, audit, image scan, Compose, kubeconform, integration, OpenSandbox, and OpenViking contract gates remain covered by required CI

Release boundary

The following still block v2.0.0:

• approved live Provider, OpenSandbox, and OpenViking lifecycles on the final SHA;
• target-like single/split capacity and one-to-four worker scaling evidence;
• an eight-hour target-like soak with zero errors and no unexplained resource growth;
• target-cluster fault, backup/restore, and rollout/rollback drills;
• final API stability, v1 maintenance-window, and migration approval;
• one independent PR approval;
• explicit owner authorization before merge, version bump, annotated tag, candidate preparation, local PyPI upload, and final public GA publication.

main protection, ga-release, and ga-evidence are configured with required reviewer kangkangzi2025 and self-review prevention. The target runner, evidence-root variable, approved live credentials, and target cluster still require external setup. See release/checklists/v2.0.0-ga.md, release/manual-pypi-v2.0.0.md, and deploy/docs/drills-v2.md.

[Tokisakix]

CI supervision complete for cbba110630cb4954b4d5bad405d88f7d5e4bc9c1.

• 9 substantive checks: SUCCESS
• 1 generated matrix placeholder: SKIPPED (not a required or failing check)
• Merge state: CLEAN / MERGEABLE

CI fixes made during supervision:

1. Replaced the runtime-installed Trivy Action with the verified aquasec/trivy:0.67.2 image pinned by digest, preserving image vulnerability, CycloneDX SBOM, and repository secret gates.
2. Replaced two runner-speed microbenchmarks with deterministic concurrency/integrity assertions.
3. Replaced a wall-clock parallel-tool threshold with direct max_in_flight overlap observation.

The PR intentionally remains Draft because release/evidence/v2.0.0-review/manifest.json still records external Gate D blockers and release_approved=false.