release: prove arm64, coordinated promotion, and public installers #88

Context

PR #87 establishes the reboot-safe self-hosting baseline and publishes multi-architecture candidate manifests, but three release assurances remain intentionally deferred. The immutable v0.4.1 release does not contain the #87 recovery behavior; a new release must not claim these assurances until this issue is closed.

Scope

• Native arm64 runtime lane: run entrypoint and health/recovery smoke tests on native arm64 for all five published variants:
  • opencli-admin-api
  • opencli-admin-frontend
  • opencli-admin-agent
  • opencli-admin-chrome
  • opencli-admin-agent:<candidate>-chrome
• Coordinated promotion/rollback: design and prove failure handling for promotion of the five candidate manifests to versioned and latest tags. A failure partway through promotion must not leave a mixed public release without an explicit rollback/recovery procedure and evidence.
• Public installer E2E: in dedicated clean release-gate environments, download the GitHub Release assets and execute both scripts/install.sh and scripts/install.ps1 through secret generation, Compose startup, login/health verification, and reboot/recovery checks.

Acceptance evidence

1. Native arm64 job logs identify host architecture and prove every published variant starts and satisfies its relevant health contract.
2. A controlled promotion failure demonstrates either coordinated rollback or a documented fail-safe state with deterministic recovery.
3. Unix and PowerShell installer runs start from downloaded release artifacts, not repository checkout helpers, and prove first-install behavior end to end.
4. The release remains blocked until all candidate-image and installer gates succeed; evidence links are attached to the release.

Boundaries

• Keep candidate manifests as immutable audit artifacts.
• Do not weaken signature/provenance, secret generation, health, authentication, or restart checks to make the gate pass.
• This follows PR feat: integrate governed runtime and reboot-safe self-hosting #87; it is not part of that already-green integration PR.