release: integrate outbound TLS platform evidence

[jtenner]

Summary

• define and test the exact TinyGo-supported networking surface while keeping the real outbound TLS engine explicitly standard-Go-only
• add a named standard-Go TLS signoff matrix and retain both TLS and TinyGo logs in CI/release evidence
• expand arm64 cross-build evidence to root networking, gotls, mixed lneto TLS transport, and public TLS composition
• bind TLS/TinyGo/arm64 platform evidence into provenance schema v3 while retaining schema-v2 verification compatibility
• refresh the complete benchmark baseline with TLS handshake, fixed-ring, authorization, TCP-port-lease, and live round-trip measurements
• document the client-only, granular-only, experimental TLS release boundary and the fail-closed strict-gate blocker

TLS scope is unchanged: no server TLS, no aggregate registration, no tls/register, no net-tls bundle, and no TinyGo TLS stub.

Validation completed locally

• go test ./...
• shuffled full tests
• full and focused race tests
• go vet ./...
• source-boundary and checkptr scripts
• Linux/386 package matrix
• standard-Go TLS signoff: 10 ordinary package profiles, 7 race package profiles, 109 resolved named test targets; all 17 package runs passed
• TinyGo 0.41.1 supported matrix using both the development workspace and a release-style exact modfile: 128 repository packages discovered, 123 supported packages passed, 5 standard-Go-only packages retained explicitly
• fuzz discovery: 44 targets in 33 packages; all passed a final 3-second smoke run; each of the four TLS-owned targets also passed an individual 30-second run
• focused TLS repetitions: 100x ordinary and 20x race, including mixed TCP/TLS local-port leases, TLS-scoped loopback, exactly-once EOF, truncation, and teardown
• custom CLI inspection: standard Go and TinyGo matched for all 12 canonical bundles
• arm64: all four configured binaries cross-compiled; local execution is skipped-no-runner
• benchmark baseline: 172 top-level targets in 50 packages and 195 expanded result names, five 200 ms samples with GOMAXPROCS=1 and -benchmem

Representative TLS 1.3 handshake median: approximately 1.465 ms/op, 388,334 B/op, 935 allocs/op. Fixed ring, profile authorization, TCP port leasing, and live TCP round-trip retained zero-allocation results.

Hosted CI

The initial PR run completed successfully for test/shuffle/vet, race, checkptr/386,
standard-Go TLS signoff, the TinyGo-supported package surface, and CodeQL. The
TinyGo job exercised all 123 supported packages with pinned TinyGo 0.41.1 and
completed in 46m56s. Fuzz and benchmark smoke jobs were skipped as intended for
a pull-request event; they run on their configured scheduled/manual events.

Strict release gate

Attempted with:

RUN_WASI=1 FUZZTIME=30s scripts/release-signoff.sh

using exact clean reconstructed inputs, including production Wago commit 97e6f91e6c822491577faa86f3c30aa5a8fff1e8 with tree adbba31c51996f1c1d6d3c2069de8ddf0afd94ee and ordered parents 54499ba5135f69a062e23a7255f4a408d6cecf8c, ffd5ef4b122cbd019897eeea3503789ab5860e4a.

The gate stopped fail-closed during current-plugin-topology-audit, before repository test execution, because Wago origin/main has moved to 7794acc82692aac4ff98756a46a017d0d8768087, beyond the reviewed ff04a6b1 topology. The upstream lifecycle and preview-1 integrations must be re-reviewed and re-ported before adoption. No provenance manifest or review bundle was produced by the stopped run.

Remaining release blockers

• accepted arm64 runner execution evidence is still required; local evidence is cross-build-only
• current Wago topology must be re-reviewed before the strict release gate can proceed
• real TLS remains intentionally unsupported under TinyGo 0.41.1

For these reasons this PR is intentionally opened as a draft and does not claim production TLS readiness.