feat(release): release-gated asset + image jobs, port release-notes tool (RIG-2915)

[rigel-mintaka]

This PR is part of a stack containing 2 PRs:

1. main
2. "feat(release): release-gated asset + image jobs, port release-notes tool (RIG-2915)" (this PR)
3. feat(release): version.txt base for bundle, required-image release posture, unified-lane docs (RIG-2916) #743

T3 of the frozen unified-release-lane design
(docs/designs/platform/compass-unified-release-lane.md, §A4/§A5/§A6). Stacks on
T1+T2 (RIG-2914). Appends two release-gated jobs to .github/workflows/release.yml
(append-only: 347 insertions, no existing release-pr/publish-image job touched)
and ports the release-notes generator the closed #711 draft carried.

Both new jobs gate on github.ref == 'refs/heads/main' && needs.release-pr.outputs.releases_created == 'true' — they run only when a merged Release PR actually cut a release, and the main-ref guard rides every release job (§A5(2)) so a feature-branch workflow_dispatch can never mint release artifacts.

release-assets (contents: write only)

Builds the four released binaries at the release sha and attaches them to the Release release-please already created:

• 3 linux-amd64 daemons/CLI + 1 darwin-arm64 CLI (CGO_ENABLED=0 + -trimpath), version stamped from version.txt via -X main.version (Global Constraint 1: one version string across all binaries and the image tag). Asset names carry the semver tag (compass_vX.Y.Z_linux-amd64, …).
• SHA256SUMS over the four assets.
• Runs the ported tools/release-notes generator (--tag the semver) to produce the body appendix + nix-outputs.json manifest.
• gh release upload --clobber (idempotent on re-run) + appends the appendix below release-please's generated changelog notes via gh release edit --notes-file — never overwrites the changelog, never creates the Release, not --prerelease.

release-image (contents: read + packages: write)

Digest-re-tags the already-published per-push :git-<sha12> image to :vX.Y.Z — never a second build, never touches :latest (§A4, DL-299):

• Shares the publish-agent-image concurrency group under cancel-in-progress: false + queue: max — a non-superseding release mint serializes behind an in-flight :latest move without being dropped (§A4 no-drop).
• Registry-anchored resolver (a path-based git log -- <paths> resolver was rejected, §A4:159-164): walks first-parent ancestors of the release sha newest-first, bounded to 50, and takes the first :git-<sha12> that resolves on GHCR — that tag's tree provably contains every closure change at-or-before it. Hard-fails with a workflow_dispatch remediation pointer if none resolves in bound; never rebuilds.
• skopeo copy the resolved digest manifest to :vX.Y.Z (registry-side write), then verifies config-digest coherence against the source tag (same shape as publish-image's check); hard-fails on mismatch.

tools/release-notes/ (ported verbatim from the closed #711 draft)

The T2 generator (6 files) ported byte-for-byte — assemble() pure core, the import.meta.main edge, and 18 tests unchanged. The semver --tag flows through as an opaque string label (no code change). The nullable-image degradation (IMAGE_ABSENT_LINE) is preserved as-is: flipping it to a required-image failure at release time is T5 (RIG-2916), not T3. bun.lock regenerated for the new @compass/release-notes workspace member.

Refs RIG-1746
Refs RIG-2915
Ledger-impact: none
Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-1746

RIG-2915

[github-actions]

Compass engineering docs preview: https://compass-native-rig-2915-rele.compass-eng-docs.pages.dev

Deployed from compass-native/rig-2915-release-gated-jobs at fda0de1.