[WittsEnd2]

Adds a tag-driven release pipeline, so the public project ships named, verifiable versions. Production is unchanged: it still builds on the host from docker-compose.prod.yml.

On a pushed vX.Y.Z tag (vX.Y.Z-pre for prereleases), .github/workflows/release.yml:

1. verify: the tag equals __version__ and the pyproject version, the CHANGELOG section with Upgrade notes exists, and the tag is on main.
2. test: reuses ci.yml via workflow_call, so the full unit and integration gate runs.
3. publish-image: ghcr.io/ragnar-security/lab-playground, linux/amd64 and arm64, with BuildKit provenance and SBOM plus a GitHub build-provenance attestation. The X.Y and latest aliases are computed from the protected tags (release_version.py aliases), never from timing.
4. attest-bundle and release: a reproducible deploy bundle, built from git objects so untracked operator files can never enter it, plus SHA256SUMS, an attestation, and the GitHub Release with CHANGELOG notes and bound verify commands.

Security (Codex security audit: two rounds, final APPROVE):

• Only tag pushes publish. Every job with write permissions is tag-push-only and runs in the release environment (v* tags only, approval by lab-playground-maintainers, admins cannot bypass). Tag creation is restricted to that team by a ruleset.
• workflow_dispatch is always a read-only dry run.
• Every action in both workflows is pinned to a commit SHA; checkouts don't persist credentials.
• All publishing runs share one concurrency queue (queue: max, GitHub 2026-05-07; a narrow actionlint ignore until actionlint supports it).
• The docs and release notes verify with --signer-workflow .../release.yml --source-ref refs/tags/vX.Y.Z (plus --source-digest in the notes).
• Residual, documented in docs/RELEASING.md: GitHub has no push rulesets for public repos, so any repo writer could author a workflow that uses GITHUB_TOKEN to write packages. Such artifacts fail the bound verification.

Other changes:

• /auth/health reports version and revision.
• Dockerfile.prod gets OCI labels.
• The pyproject version (0.1.0) and __version__ (1.0.0) disagreed; both are now 1.0.0, with a consistency test.
• CHANGELOG.md.
• A docker-compose.release.yml override (image instead of build; nothing else changes).
• Preflight refuses a moving LAB_PLAYGROUND_VERSION.
• The release helpers are kept out of the runtime image.
• Docs: docs/RELEASING.md, docs/DEPLOY-FROM-RELEASE.md, README, PRODUCTION_DEPLOYMENT.md.

Verification:

• TDD, red then green; 1117 passed, 5 skipped; actionlint clean.
• amd64 smoke test on a dev VM: image labels and version; a stack run from the unpacked bundle with the override had healthy containers, /auth/health returning version and revision, 401s on protected routes, and all six migrations OK.
• Bundle: planted operator files are excluded, and builds are byte-identical across machines.
• Next, after merge: a dry run of release.yml from main (the first arm64 build), then tag v1.0.0.