bt6-release-validation

# BT6 Release Validation Validate an existing tag before publishing or promoting release artifacts. Apply `bt6-maintainer-guardrails`. This workflow does not create, move, or delete tags and does not publish a release without separate explicit authorization. ## Required context 1. Resolve the canonical repository, CI remote, base branch, profile, expected actor, and release authority from project configuration and live state. 2. Resolve the requested tag to an immutable commit and record whether the tag is signed or annotated when repository policy requires it. 3. Refuse an ambiguous, missing, moving, or policy-disallowed tag. Never validate the working tree as a substitute for the exact tagged commit. 4. Use an isolated checkout or worktree so validation does not overwrite local work. ## Required validation 1. Run every repository-profile `validation.full` command at the exact tagged commit. 2. Run applicable `documentation`, `researchIntegrity`, and risk-surface checks. 3. Run repository-defined source-snapshot integrity, compatibility, and supported-platform checks. Verify the release ZIP comes from the tagged source rather than an unrelated checkout; do not require a compiled package. 4. Compare local evidence with CI for the same tag and commit. Record missing or stale evidence as incomplete, not passing. 5. Treat warnings, flakes, skips, coverage changes, and conditional-gate gaps according to repository release policy; do not inherit the relaxed PR turnaround budget as a release exemption. 6. When `releaseEvidence` is configured, verify every artifact against the canonical checksum manifest, authenticate its SLSA/in-toto attestation, validate the source-SBOM binding, and prove promotion uses the tested snapshot-once ZIP bytes. A checksum without authenticated provenance is incomplete evidence. ## Decision - `pass` only when every required check succeeds for the exact tag commit. - `fail` for any failed required check or artifact/source mismatch. - `hold` when the tag, authority, profile, platform evidence, or required command cannot be resolved safely. Do not promote artifacts or describe the tag as released after `fail` or `hold`. Use `templates/bt6-release-validation-report.md` and record the event that makes the evidence stale.