ci(governance): protect binary-only HMG public promotion

[monkseekee-max]

Outcome

Centralizes a protected binary-only HMG to HMG-public promotion path and keeps the organization workflow-security gate in the same governance change.

Binary-only publication contract

• Source is one successful Build public release artifacts (no publish) workflow_dispatch run from protected HMG/main.
• The run name, workflow path, event, completion, conclusion, main head SHA, Actions URL, artifact identity, expiry state, and non-empty payload are checked through the GitHub API.
• The only accepted artifact is hmg-public-<version>-<source_sha> from that exact run.
• The downloaded shape must be exactly public-release/, public-release-set.json, and public-release-verification.json.
• HMG own verify-hmg-public-release-set.py is rerun from the exact checked-out source SHA.
• The governed release set is exactly 17 files: six core archives, six desktop installers/packages, two checksum manifests, two installers, and version.json.
• The source SHA must be reachable from protected HMG main; the logical release tag and checked-in Cargo version must match.

This path has no dependency on an HMG private Release, an HMG tag-push workflow, npm publication, website synchronization, or source export. It creates no HMG private Release/tag/npm/site side effects.

Target repository boundary

• The candidate starts from protected HMG-public/main.
• It does not run sync-export.sh and does not change public product source, website, or npm content.
• Its only repository change is release-provenance/v<version>.json, containing secret-free source repository/SHA/run/artifact and 17-asset digest metadata.
• Central quality fails closed unless that metadata file is the sole added path and exactly matches the signed trailers.
• The exact 17 assets are sealed, signed, restored, and reconciled through the deterministic HMG-public staging release.
• Automation opens a promotion PR and may register rebase auto-merge, but never writes HMG-public/main, never reviews itself, and is not a bypass actor.
• The protected HMG-public publisher remains the only component allowed to create the final public tag and immutable public Release after merge and environment approval.

Trust boundaries retained

• Source preparation and candidate validation run without the target write credential.
• The Ed25519 signer uses permissions: {} and receives only canonical validated scalars.
• The target token is exposed only after sealed-bundle and detached-signature verification.
• Target-owned .github governance and publisher policy remain unchanged by promotion.
• Promotion commits contain exactly eight signed provenance trailers.
• Public quality remains read-only and validates PR/merge-group event binding, exact candidate tree, signature, metadata, public builds, drift/leak policy, and final-tag absence.

Organization workflow security

The PR also retains the immutable changed-workflow security gate: exact github.workflow_sha policy checkout, exact event-head target checkout, pinned Actions, explicit least privilege, safe hosted runners, untrusted-input controls, and direct-main-write rejection.

Verification

• actionlint -color: passed
• bash governance/workflow-policy/test.sh: 41/41 passed
• changed-workflow policy audit: 2 checked, 0 violations
• git diff --check: passed
• stale private Release/tag-push/ten-asset assumptions: removed

Activation boundary

This PR changes central reusable policy only. It does not trigger promotion or publication. Callers and HMG-public wrappers must pin the reviewed merged full SHA before the replacement path becomes active. Auto-merge remains disabled pending independent Core and Security review.

[monkseekee-max]

@HMG-AI/core-maintainers @HMG-AI/security-managers 请基于最新推送 b6adfe068e9de90cc4615fff8aa3eab06cbcbe32 重新审查并批准。重点请确认：来源仅为 HMG protected-main 上成功的 public-only Actions artifact；契约为 exact 17 assets；不依赖或修改 HMG private Release/tag，不运行 source export，不同步源码/网站/npm；HMG-public candidate 仅新增一份 secret-free release-provenance/v<version>.json，最终 public tag/Release 仍受 staging、签名、PR、CODEOWNER 与 protected publisher 约束。

[monkseekee-max]

Binary-only v1.7.7 release candidate is now built and independently verified.

• Source: HMG-AI/HMG@e67aa728f280fc22f6c1596f6c245d0e6bca2e8f (protected main)
• Build run: https://github.com/HMG-AI/HMG/actions/runs/29496232620
• Artifact: hmg-public-1.7.7-e67aa728f280fc22f6c1596f6c245d0e6bca2e8f (unique, unexpired)
• Exact public assets: 17/17
• Independent verifier: ok: true
• Evidence SHA-256: 325957069ae54a646661aec665a00ad55fd67647f6edc3c23bbdd22e7ad609a2
• Core and Desktop checksum manifests: all entries verified

This promotion remains binary-only: no HMG private release, source sync, website, npm, or PyPI publication. Independent required approvals are still needed; please review without bypassing the protected rules.