release: add the ASF source candidate workflow

[M4n5ter]

English

Part of #2974 — G2: source release mechanics.

Outcome

Provide a reviewed source-only Apache Incubator release-candidate workflow that
produces, verifies, and documents the exact bytes used for a vote without
placing a Release Manager's private PGP key in CI.

Exit criteria

• Build apache-maka-<version>-incubating-src.tar.gz from an immutable Git
  commit with one matching top-level directory.
• Produce and verify SHA-512 for the exact archive.
• Provide a local detached-signature command and verify signatures against
  a reviewed KEYS file in an isolated keyring.
• Reject missing release documents, unsafe paths, generated/private paths,
  and version mismatches.
• Demonstrate that the same commit and version produce identical bytes.
• Extract the exact candidate in CI and install, audit, build, type-check,
  run release checks, and test from that extracted source.
• Document candidate tags, local signing, KEYS, Apache dist/dev staging,
  independent verification, podling/IPMC votes, and immutable RC handling.
• Run the manual workflow successfully for a reviewed commit.

Existing work

• feat(release): add ASF source candidate workflow #3278 was merged into main as 84fbe05d. It implements the
  builder/verifier, focused tests, manual GitHub workflow, and Release Manager
  runbook.
• fix(runtime-host): remove stale surface inputs #3332 fixed the stale Runtime Host test input exposed by clean-archive
  validation.
• Manual validation run 32376142358
  completed successfully from reviewed main commit
  98bdd6cf8add2900a3db9cc27a2cb623f1148a5e. Every clean-archive verification
  step passed and the verified unsigned candidate artifact was uploaded.

Out of scope

• Desktop installers, npm packages, bundled Git, and convenience binaries.
• Performing authenticated PGP signing or Apache distribution writes in CI.
• Deciding whether provenance or legal documents are release-ready.

References

• Incubator release management
• Incubator distribution guidelines
• ASF release policy

Ownership

M4n5ter coordinates this gate and owns the current implementation. Link the
reviewed implementation PR here once it is opened; release approval remains
with the PPMC, mentors, and IPMC.

简体中文

#2974 的一部分——G2：源码发版机制。

目标结果

提供一套经过审查的 source-only Apache Incubator RC 工作流，生成、验证并记录投票所用
的精确字节，同时不在 CI 中保存 Release Manager 的个人 PGP 私钥。

完成条件

• 从不可变 Git commit 构建 apache-maka-<version>-incubating-src.tar.gz，
  并且归档只有一个匹配的顶层目录。
• 为精确归档生成并验证 SHA-512。
• 提供本地 detached signature 命令，并在隔离 keyring 中使用经过审查的 KEYS
  验证签名。
• 拒绝缺少发版法律文件、不安全路径、生成/私有路径及版本不一致的归档。
• 证明相同 commit 和版本能够生成完全相同的字节。
• CI 解压精确候选，并从解压后的源码执行安装、审计、构建、类型检查、发版检查和测试。
• 记录 candidate tag、本地签名、KEYS、Apache dist/dev 暂存、独立验包、
  podling/IPMC 投票及不可变 RC 的操作流程。
• 针对一个经过审查的 commit 成功运行手动 workflow。

已有工作

• feat(release): add ASF source candidate workflow #3278 已作为 84fbe05d 合并到 main，实现了 builder/verifier、专项测试、
  手动 GitHub workflow 和 Release Manager runbook。
• fix(runtime-host): remove stale surface inputs #3332 修复了干净归档验证发现的 Runtime Host 过时测试输入。
• 手动验证 run 32376142358
  已从经过审查的 main commit
  98bdd6cf8add2900a3db9cc27a2cb623f1148a5e 成功完成；所有干净归档验证步骤均通过，
  且已上传经过验证的 unsigned candidate artifact。

不在范围内

• Desktop 安装包、npm 包、bundled Git 和 convenience binaries。
• 在 CI 中执行需要身份认证的 PGP 签名或 Apache 分发写入。
• 判断来源或法律文件是否已经具备发版条件。

参考资料

• Incubator 发版管理
• Incubator 分发指南
• ASF 发版政策

负责人边界

由 M4n5ter 协调这一 gate 并负责当前实现。经过审查的实现 PR 创建后在这里关联；
发版批准仍由 PPMC、mentors 和 IPMC 负责。