[mtwilliams]

Assemble native/Hex/docs artifacts and a source dependency inventory, require all seven release targets, check archive contents/architectures, generate SHA-256 manifests and conventional-commit release notes, and stage attested draft releases. Publishing is isolated behind a protected environment, explicit repository opt-in, ownership configuration, provenance/checksum verification, and Hex workload identity.

The inherited native dependency graph initially reported 13 advisories. Remove unused dependencies and refresh affected compatible dependencies while pinning ort at rc.8 and retaining Rustler 0.29. The refreshed audit reports zero vulnerabilities and zero informational warnings. Mix/Cargo versions now agree.

Validation: all shared checks and 12 tooling tests; 117 library/doctest checks, 3 model goldens and 3 system scenarios; clean source/prebuilt package checks including missing-runtime rejection; minimum Rust build; docs/inventory; partial local assembly/notes. Full target execution is requested on this final stack head. No tags, releases, Hex publications, organization settings, or existing feature refs changed.

Before enabling Hex publishing, select/confirm the fork package identity and configure its ownership/workload identity. The current package name/version are inherited; this PR does not publish over an existing Hex version. Based on foundation/ci.

CI evidence: validation run. The full run covers eight native combinations and both Alpine architectures, including Rust-free prebuilt consumers, then verifies the complete seven-target release bundle. Local dependency audit: zero vulnerabilities and zero informational warnings. Elixir-only coverage baseline: 51.43%; native/system execution is outside that metric.

Stack (merge in order): #32 → #33 → #34 → #35 → #36.