Gate v1 publication on final-RC integration and built-artifact verification

[BenWestgate]

V1 publication must qualify the exact wheel/sdist bytes that are later published.

Required release gate:

1. freeze the source commit and require the normal supported Python/OS checks;
2. run the real Bitcoin Core v32 integration/fixture checks on the release candidate;
3. run optimized/static/differential qualification;
4. build wheel and sdist once;
5. install those exact artifacts into clean qualification environments;
6. record commit, package/tag, dependency/Core versions and SHA256/provenance;
7. publish only the same qualified bytes.

Implemented in focused PR #52. Current head a653876 is mergeable and exact-head Python-package run 278 passed. The workflow stages qualified artifacts on a draft GitHub release, rechecks hashes/provenance immediately before publication, publishes to PyPI, then makes the GitHub release public. The tag-push publication path cannot execute from the PR itself and still requires the normal release-environment approval on the first real tag.

Bitcoin Core v32.0rc2 remains the currently recorded signed v32 candidate in #52; the separate release monitor will repin only when a newer signed RC or stable v32.0 appears. Keep this issue open until #52 is integrated and the final frozen candidate reaches the actual release-qualification step.

[BenWestgate]

Bitcoin Core release monitor (2026-09-25): 32.0 is still in RC; the official bitcoin-core-32.0/ index currently contains only test.rc2/, and the public download page lists 31.1 as latest stable. Release qualification should therefore treat PR #51's 32.0rc2 run as pre-final evidence, not the final v1 Core qualification. When a newer RC/final appears, repin and rerun before publication.

When stable Bitcoin Core 32.0 is released, also clean up BenWestgate/Bails#244: remove the now-dead 32.0rc2 fallback (VER=32.0rc2 / bitcoin-core-32.0/test.rc2) after confirming Bails follows the normal stable-release path.

[BenWestgate]

Bitcoin Core release monitor refresh (2026-09-26): upstream bitcoin/bitcoin still exposes v32.0rc1 and v32.0rc2 under the v32.0 tag namespace, with no final v32.0 tag. Keep #51/#52 pinned to rc2 as pre-final evidence; repin and rerun both the fixture gate and exact-artifact qualification if rc3 or final appears before publication.

[BenWestgate]

Bitcoin Core release monitor refresh (2026-09-28): upstream still has v32.0rc2; refs/tags/v32.0rc3 and the final v32.0 release are absent. Keep #51/#52 pinned to rc2 as pre-final evidence only. If rc3 or final appears before publication, repin the pinned archive/hash and rerun both the real-Core fixture gate and exact-artifact release qualification.

[BenWestgate]

Bitcoin Core release monitor refresh (2026-10-01): upstream bitcoin/bitcoin still exposes only v32.0rc1 and v32.0rc2 under the v32 tag prefix; there is no v32.0rc3 or final v32.0 tag. Keep #51/#52 pinned to rc2 as pre-final evidence only. If a newer signed RC or final appears before publication, repin the archive/hash and rerun both the real-Core fixture gate and exact-artifact release qualification.