Gate v1 publication on final-RC integration and built-artifact verification

[BenWestgate]

Problem

The normal CI matrix is strong and currently green, but the release workflow can publish artifacts that were built for the release without first qualifying those exact artifacts as installed software.

Current CI runs the supported OS/Python matrix, unit tests, mypy, Ruff, differential correction verification, differential wallet verification, and package build. The repository also contains stronger release-relevant tools, including the real Bitcoin Core regtest integration harness and an installed-wheel verifier.

The publish workflow currently triggers from a published GitHub release, builds wheel/sdist artifacts, uploads them, and publishes them to PyPI. It does not first install and test the exact built artifacts that will be distributed.

For v1, the release process should prove that the bytes users install are the bytes that passed release qualification.

Proposed release gate

Before publishing v1 or an RC intended for v1 qualification:

1. Freeze the release commit.
2. Require the normal supported OS/Python CI matrix to pass on that commit.
3. Run the real Bitcoin Core regtest integration harness against the supported Bitcoin Core release.
4. Run the release-specific verification tools, including the differential verifiers and any other checks designated as mandatory for release qualification.
5. Build the wheel and sdist once.
6. Install those exact artifacts into clean environments.
7. Run installed-package smoke tests, including tools/verify_installed_wheel.py, against the installed package rather than the source checkout.
8. Publish only the same artifact bytes that passed qualification.

Release record

Record enough information to identify exactly what was qualified:

• source commit SHA;
• package version/tag;
• dependency versions used for qualification;
• Bitcoin Core version used by the integration test;
• SHA256 hashes of the published wheel and sdist;
• result/status of the required qualification jobs.

Acceptance criteria

• Publication is blocked unless release qualification succeeds.
• The Bitcoin Core regtest integration is part of the release gate.
• The exact wheel/sdist intended for publication are installed and tested in clean environments.
• Installed-artifact tests do not accidentally import the repository source tree.
• The artifacts published to GitHub/PyPI are byte-for-byte the artifacts that passed qualification.
• Release provenance records the source commit, dependency set, Core version, and artifact hashes.