chore(delivery): align BT6 build and release gates (#160)

Make the contributor, CI, package, and tagged-release contracts agree with the shared BT6 baseline while preserving T3MP3ST's project-specific integrity checks. Exclude workspace-only material from published packages and keep local-agent detection tests host-independent.\n\nCloses #159

docs/PULL_REQUEST_DELIVERY.md

@@ -72,6 +72,14 @@ both human contributors and coding agents.
    - screenshots or artifacts for UI/reporting changes
    - residual risk or follow-up work
 
+7. Preserve review identity and history.
+
+   Sign contributor commits with a key associated with your forge identity (or
+   GitHub's verified web flow). Do not force-push a published review branch;
+   add corrective commits. Maintainers recheck the exact head, required CI,
+   mergeability, and linked issues immediately before the configured squash
+   merge.
+
 ## Coding-Agent Instructions
 
 When an agent prepares a PR, it must perform a final scope audit before posting.
@@ -139,3 +147,10 @@ feature details while stale-base deletions remain in the diff.
 Only comment on PRs that need action: concrete fixes, missing verification,
 missing receipts, or a rebase/scope cleanup. Ready PRs should not receive
 process comments.
+
+When a contributor has substantially completed a significant reviewed change
+and only narrow mechanical cleanup remains, maintainers may resolve the small
+conflict, preserve an established default, or add focused regression coverage
+as a courtesy. Re-run the full exact-head review and tests and tell the
+contributor what changed. Large rebases, behavior changes, architectural
+judgment, or newly discovered substantive defects remain contributor work.

docs/RELEASE_CHECKLIST.md

@@ -19,6 +19,7 @@ npm run test:no-self-fitting
 npm run test:no-phantom-tools
 npm run test:gate
 npm run prompt:audit
+npm run pack:dry-run        # inspect the allowlisted package manifest; no workspace/private files
 ```
 
 ## 2. Local API smoke (loopback only)
@@ -56,8 +57,22 @@ degrade gracefully — they never fail the core run.
 
 ## 6. Publish
 
+- Confirm the release commit is already on `main`, CI is green at that exact
+  SHA, the version and changelog agree, and the tag is signed and points to that
+  commit. Never move or reuse a failed release tag; correct the release and use
+  a new version/tag.
 - Verify `repository.url` in `package.json` points at this repo. To retarget it:
   ```bash
   npm pkg set repository.url="git+https://github.com/<owner>/<repo>.git"
   ```
 - Tag the release only after Sections 1–2 are green.
+- Push the `v*` tag and wait for the tag workflow. It reruns
+  `npm run test:release`, the high-severity dependency audit, and the package
+  dry run against the exact tag, then retains the tested `.tgz`, its manifest,
+  and `SHA256SUMS` as workflow artifacts.
+- Inspect `pack-result.json`: only the allowlisted runtime, scripts, tools,
+  documentation, examples, and package metadata may ship. Workspace notes,
+  tests, AIWG/provider deployment internals, secrets, and local artifacts are
+  release blockers.
+- Publish the retained, checksum-matched package artifact. Do not rebuild a
+  different archive from another checkout after certification.