- build-release.sh: POSIX-only checks (dash runs the release), a release form
is exactly X.Y.Z or X.Y.Z-alpha|beta|rcN, and the install smoke refuses a
package that has no smoke recipe.
- Tests: names and tag gate (exact match, committed template must agree), key
refusals before any container starts (fake podman records calls), the
render script pins only the build tree, podman wiring (only the sign phase
sees the key, and it has no network), the xbps ordering of pre-release
spellings, the workflow gates, tmpfs key staging, and the publish set
(sdist, packages, signatures, repodata, client key).
xavierk
80fb4365bd