- build-release.sh: POSIX-only checks (dash runs the release), a release form
is exactly X.Y.Z or X.Y.Z-alpha|beta|rcN, and the install smoke refuses a
package that has no smoke recipe.
- Tests: names and tag gate (exact match, committed template must agree), key
refusals before any container starts (fake podman records calls), the
render script pins only the build tree, podman wiring (only the sign phase
sees the key, and it has no network), the xbps ordering of pre-release
spellings, the workflow gates, tmpfs key staging, and the publish set
(sdist, packages, signatures, repodata, client key).
Model recommendation keyed to the installed build and free memory, fork-sourced Void templates, signed xbps release workflow on Gitea with the pinned repository key, niri injection guard and wtype-first order, tightened naming sweep, web copy fixes, and CI security and duplication fixes.
xavierk