chore: harden the public release

[copyleftdev]

Summary

• close the remaining conformance mutation-test gaps and pin the verified Rust 1.95 MSRV
• add public-project security, support, contribution, issue, Dependabot, license, source, and secret-scanning policy
• add tag-driven native GitHub Releases with checksums, CycloneDX SBOMs, third-party license notices, and signed provenance
• explicitly keep all workspace crates out of crates.io; distribution remains GitHub Releases

Verification

• scripts/gates.sh
• cargo +1.95.0 check --workspace --all-targets --locked
• cargo deny check advisories bans licenses sources
• gitleaks git --no-banner --redact --exit-code 2 .
• actionlint
• cargo-about license report generation
• cargo-cyclonedx SBOM generation (241 components)
• Linux release archive/checksum dry run
• full conformance mutation sweep: 366 mutants, 347 caught, 19 unviable, 0 missed
• hosted CI: quality, advisory audit, supply-chain scan, Linux, macOS, and Windows all green

Rollout

Merge this PR before enabling repository security settings or changing visibility. The public visibility switch remains a separate deliberate action.

Summary by CodeRabbit

• New Features

  • Added automated releases for Linux, macOS, and Windows with checksums, SBOMs, license information, and signed provenance.
  • Added an in-app licenses page showing third-party license details.
  • Added structured bug-report and feature-request forms, plus private vulnerability reporting.

• Bug Fixes

  • Improved conformance testing accuracy for parameter handling, schema generation, numeric bounds, pacing, and response classification.

• Documentation

  • Added installation, verification, support, security, contribution, and conduct guidance.
  • Documented the Rust 1.95+ requirement and release verification steps.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 70b63ab4-cc33-4302-8778-89832110046d

📥 Commits

Reviewing files that changed from the base of the PR and between ce72ba4 and 9ae5ffc.

📒 Files selected for processing (33)

• .github/ISSUE_TEMPLATE/bug.yml
• .github/ISSUE_TEMPLATE/config.yml
• .github/ISSUE_TEMPLATE/feature.yml
• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/release.yml
• .gitignore
• .gitleaksignore
• CHANGELOG.md
• CODE_OF_CONDUCT.md
• CONTRIBUTING.md
• Cargo.toml
• README.md
• SECURITY.md
• SUPPORT.md
• about.hbs
• about.toml
• crates/kahea-conformance/Cargo.toml
• crates/kahea-conformance/src/lib.rs
• crates/kahea-conformance/tests/generation.rs
• crates/kahea-core/Cargo.toml
• crates/kahea-evidence/Cargo.toml
• crates/kahea-exec/Cargo.toml
• crates/kahea-ingest/Cargo.toml
• crates/kahea-ingest/src/imports.rs
• crates/kahea-mcp/Cargo.toml
• crates/kahea-plan/Cargo.toml
• crates/kahea-test-server/Cargo.toml
• crates/kahea-workflow/Cargo.toml
• crates/kahea/Cargo.toml
• deny.toml
• rust-toolchain.toml
• scripts/sbom.sh

---

📝 Walkthrough

Walkthrough

The pull request updates conformance generation and execution checks. It adds Rust workspace metadata, dependency policies, CI supply-chain checks, cross-platform release automation, license reporting, issue forms, and project governance documentation.

Changes

Conformance execution

Layer / File(s)	Summary
Generation and validation rules crates/kahea-conformance/src/lib.rs	Generation updates optionality, recursion, numeric bounds, string patterns, booleans, and negative omissions.
Execution integrity and validation tests crates/kahea-conformance/src/lib.rs, crates/kahea-conformance/tests/generation.rs	Campaign pacing is centralized. Tests cover integrity checks, outcomes, depth limits, invalid values, response classification, and sanitized errors.

Release and project operations

Layer / File(s)	Summary
Workspace metadata and release inputs Cargo.toml, crates/*/Cargo.toml, rust-toolchain.toml, deny.toml, about.toml, about.hbs	Workspace packages inherit release metadata. Rust 1.95.0, cargo-deny policies, and license-report configuration are added.
Quality and supply-chain automation .github/dependabot.yml, .github/workflows/ci.yml, .gitleaksignore	Dependabot groups weekly updates. CI pins Rust 1.95.0, runs cargo-deny, checks supply-chain policies, and runs Gitleaks.
Cross-platform release pipeline .github/workflows/release.yml, scripts/sbom.sh, .gitignore, CHANGELOG.md	The release workflow verifies tags, builds platform archives, generates metadata, creates checksums, attests artifacts, and publishes releases.
Project intake and contribution guidance .github/ISSUE_TEMPLATE/*, CODE_OF_CONDUCT.md, CONTRIBUTING.md, README.md, SECURITY.md, SUPPORT.md	The repository adds issue forms and documents installation, contribution, support, conduct, and private vulnerability reporting procedures.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub
  participant VerifyJob
  participant BuildMatrix
  participant PublishJob
  participant Release
  GitHub->>VerifyJob: push version tag
  VerifyJob->>VerifyJob: validate tag and run gates
  VerifyJob->>BuildMatrix: pass release metadata
  BuildMatrix->>PublishJob: upload archives and checksums
  PublishJob->>Release: attest artifacts and create release

Loading

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands.}