feat(release): add reproducible signed artifacts (#19)

README.md

@@ -84,8 +84,8 @@ directory leases, authenticated join attempts, LiteNetLib mediator, caller-owned
 SDK coordination, typed connection outcomes, thin public-SDK diagnostic client,
 deterministic NAT topology harness, hostile-input controls,
 observability/operator surface, secure single-active Linux deployment, and
-numeric capacity/resilience gates are implemented. Packaging, consumer pilots,
-and final production-readiness gates remain in progress;
+numeric capacity/resilience gates, and reproducible signed release pipeline are
+implemented. Consumer pilots and final production-readiness gates remain in progress;
 participating games must not treat the current repository as a finished production
 service until those gates land.
 
@@ -106,6 +106,9 @@ hardening, smoke procedure, and recovery lifecycle are documented in
 The numeric core-state candidate profile, public launch objectives, accelerated
 soak, resilience matrix, and single-active scaling decision are recorded in
 [capacity and resilience gates](docs/operations/capacity-and-resilience.md).
+Release versions, compatibility windows, immutable artifact construction,
+signing, staged promotion, rollback, and migration are defined in
+[releases and compatibility](docs/releases/README.md).
 The scriptable host/browser/join diagnostic and its stable automation contract are
 documented in the [TestClient integration guide](docs/integration/test-client.md).
 The always-on three-party scenarios, optional Linux namespace topology, and