Harden release governance, versioning, and Pages deployment

[masarray]

Scope completed

This is phase 1 of the repository hardening work identified in the latest audit.

Release governance

• Remove public-release publication from release/vX.Y.Z branch pushes.
• Publish public releases only from semantic-version tags.
• Reject tags whose commit is not already contained in main.
• Keep manual workflow_dispatch runs private and artifact-only.
• Detect semantic-version suffixes and publish alpha/beta/RC tags as GitHub prereleases.
• Prevent prereleases from replacing the latest stable release.

Build and version consistency

• Pin the repository to the .NET 8.0.4xx feature band through global.json.
• Align CI, CodeQL, and release workflows with the same SDK feature band.
• Use stable C# 12 rather than LangVersion=latest.
• Centralize source version metadata as VersionPrefix=0.3.0.
• Remove conflicting Publisher 0.1.0 and Subscriber 0.2.0 project versions.

Website deployment safety

• Run the deterministic public-site validator directly inside the GitHub Pages deployment job.
• Trigger Pages when the validator changes.

Repository governance and documentation

• Replace the fragmented changelog with structured Unreleased, 0.3.0, 0.2.0, and 0.1.0 sections.
• Document stable tag, prerelease tag, manual artifact, and main-ancestry rules.
• Improve the pull-request template so release/build-only changes do not falsely claim live publishing tests.
• Remove the completed .release-request/v0.3.0.md marker from main history going forward.

Validation completed

All independent checks passed:

1. CI — public-site validation, restore, Publisher build, Subscriber build, tests, and dependency vulnerability reports.
2. CodeQL — full C# solution restore, build, and analysis.
3. Build Windows Release — portable publishing, installer compilation, artifact validation, silent install/uninstall, checksum generation, and private artifact upload.

Validated private workflow artifact:

• ARSVIN-0.0.0-pr.9-windows-x64
• Size: 409,103,066 bytes
• Workflow artifact digest: sha256:137438719fa6266d8b05a87919ce3b105600aef164f18af4b75c9bb4b2613948

The public release job was correctly skipped for this pull request.

Deferred to phase 2+

• Pin every GitHub Action and Inno Setup to verified immutable versions/SHAs.
• Add SBOM and build provenance/attestation.
• Add code coverage and analyzer gates.
• Extract a shared ARSVIN.Engine class library.
• Generate indexable HTML documentation and a multi-page sitemap.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.