[release] integrate and ship the checksum-audit mcli candidate

[Vonng]

Goal

Coordinate the next mcli release after the checksum audit, B4 output fix, strict policy-write validation, empty-pipe behavior, documentation, and Release workflow hardening are merged. This issue is the sequencing record; it does not authorize moving tags or publishing unverified assets.

Local source boundary

The current local main is six commits ahead of remote main (70a29504):

1. dac3f07b — add read-only object checksum verification.
2. 26af1a96 — preserve checksum records and summary in non-TTY pipelines.
3. 60f6e330 — validate named and service-account policy writes strictly while preserving permissive historical reads.
4. c16f8eec — use a regular zero-byte PUT for empty pipe input.
5. 25ebed54 — record the checksum output/automation contract.
6. f08111c6 — make Release retries tag-idempotent and fail closed.

Public bilingual design drafts are committed separately as pgsty/silo.pgsty.com@eac121e and remain draft: true.

Related gates: #5 and #6.

Completed locally

• Real-S3 TTY/non-TTY checksum matrix, report-write failure, MISMATCH/UNKNOWN exits.
• Empty/non-empty pipe and concurrent streaming checksum compatibility.
• Strict-write/permissive-read policy boundary.
• Targeted and full unit/race, vet, lint, branding, credits, module checks, dependency floors, nine-target crosscompile, and clean provenance.
• actionlint v1.7.12 and exact GoReleaser v2.17.1 config validation.
• Release-state fixture/live fail-closed checks.
• Two stale orphan Drafts removed; published releases preserved.
• Strict draft/non-draft Hugo builds, internal links, and EN/ZH visual QA.

Remote integration plan

• Push the six mc commits to a focused branch and open a PR referencing [release gate] checksum verify drops stdout when non-TTY #5 and [release gate] make Release workflow tag-idempotent and clean orphan drafts #6.
• Push eac121e to a documentation branch and open a separate site PR.
• Require DCO, Go Linux/macOS/Windows, Crosscompile, VulnCheck, and Test Release Pipeline green.
• Merge mc PR and verify the same required checks on remote main.
• Merge the documentation PR but keep the new pages draft until release readiness.
• Close [release gate] checksum verify drops stdout when non-TTY #5 after code/docs merge and hosted main CI are green.

Release preparation after source integration

• Replace the stale mcli-20260824 draft notes with a draft for the actual release tag/date.
• Disclose strict policy-write rejection behavior and the empty-pipe ETag change.
• Create one immutable RELEASE.* tag only after the final commit is selected.
• Allow the workflow to create one Draft release; verify archive/package/checksum/provenance/signature/container contents.
• Perform one controlled same-tag retry and verify exactly one Draft and one copy of each asset.
• Verify a rerun against a published release fails before build/upload; then close [release gate] make Release workflow tag-idempotent and clean orphan drafts #6.
• Publish the GitHub release only after independent asset verification.

Downstream delivery

• Update SILO Dockerfile.goreleaser from RELEASE.2026-08-26T17-15-27Z to the new immutable mcli tag.
• Verify amd64/arm64 checksums, bundled mcli, the mc compatibility alias, root/rootless execution, and real checksum audit commands inside the Server image.
• Publish the Server image only after its own CI and image acceptance pass.
• Set the bilingual checksum design pages to draft: false, rebuild, deploy, and verify both production routes.

Stop conditions

Do not publish a tag/release/image when #5 or #6 has an unresolved blocker, hosted CI is red, provenance is dirty, assets are duplicated, the Server still bundles the old client, or public documentation does not match the shipped behavior.