## Linked Issue

Related to #1817 and parked Windows runtime outcome #1818. This PR does
not close either issue.

This is a release-train publication-membership change, not a new product
issue. Labels include `no-issue` and `release`.

## Summary

Keep Windows runtime archives out of the v2026.9.0 stable cut. Live
`v0.10.4` never shipped a Windows archive; current-main Windows release
targets were prospective first-publication only. A stable tag,
attestation, GitHub release, or publication path must not build, sign,
advertise, or upload `x86_64-pc-windows-msvc` runtime assets.

Windows component compilation and tests remain supporting evidence. The
parked Windows generator is preserved as non-product #1818 compatibility
and is not invoked from github-release.

## Changes

- Drop `x86_64-pc-windows-msvc` from the non-prepare Release matrix;
prepare-only remains Darwin-only.
- Remove WinFsp staging, Windows archive packaging, Windows release-note
install instructions, and `windows_release_manifest.py` generation from
`release.yml`.
- Fail closed before attestation if a Windows archive,
`windows-release.toml`, Sigstore marker, or checksum reference is
present.
- Stable publication membership is musl-only as the current extension
set. Parked seven-archive Windows checksums remain valid only for the
parked generator/tests.
- Publication rejects every Windows archive, `windows-release.toml`,
checksum advertisement, and Sigstore marker.

## Exact head

- SHA: `ad8f49cf386fcedf9ba7f64ac57950ec68a67b92`
- Parent / `origin/main`: `3de333f1b39d41bacfb535b49d83198212bf2403`
- Unique files:
  - `.github/workflows/release.yml`
  - `scripts/classify_release_build_matrix.py`
  - `scripts/release_manifest.py`
  - `scripts/release_publication.py`
  - `scripts/test_channel_workflow_contract.sh`
  - `scripts/test_release_publication.py`
  - `scripts/windows_release_manifest.py`
  - `scripts/test_windows_release_manifest.py`

## Verification

- GPG Good [full] (`7CD32E7697286B11593246B9FA53358CB4127512`) and
matching DCO
- Classifier: `PREPARE_ONLY=true` Darwin pair; false/empty/absent Darwin
+ GNU + musl; no Windows
- `bash scripts/ci/test-release-contracts.sh`
- `python3 scripts/test_release_manifest.py`
- `python3 scripts/test_release_publication.py`
- `git diff --check`
- `release.yml` is 954 lines

## Residuals and claim limits

- Does not implement a Windows daemon or merge draft #1814.
- Does not certify musl archives; musl remains in the build matrix
pending a later cert vehicle.
- Does not bump, tag, or publish.
- Does not change `windows-filesystem-native` or
`windows-local-transport` component CI.
- Does not close #1818.

## AI / Tool Assistance

Assisted-by: Codex:zai-coding-responses/glm-5.3-flash

The publication-membership split and fail-closed Windows rejection were
authored with Codex assistance in an isolated worktree. The exact SHA,
unique file set, signature, DCO, and focused contract tests were
independently verified before this PR was opened.

## Checklist

- [x] Linked to an issue
- [x] Changelog fragment skipped for this release-guard-only change; PR
is labeled `skip-changelog`
- [x] I understand every change in this PR and can explain its design,
risks, and validation.
- [x] I reviewed and tested the meaningful tool-generated output
included in this PR.
- [x] Every non-bot, non-merge commit has a matching `Signed-off-by`
trailer.

Signed-off-by: Joshua J. Bouw <jjb@unicity-labs.com>

## Linked Issue

Related to #1817. This PR does not close the release tracking issue or
parked Windows issue #1818.

## Summary

Successor on frozen parent `dc9ad36f`. Extend the existing
protected-main `Release` `workflow_dispatch` path with a musl
prepare-only set that builds and certifies the two Linux musl archives
from exact packaged bytes. Darwin prepare-only remains the default
prepare set. Native FSKit certification and GitHub release publication
stay skipped in prepare-only mode.

This successor provisions pinned `b3sum` 1.8.5 for both the musl
certification job and candidate-owned Check/test execution through
`scripts/ci/setup_musl_certification.sh`. The helper installs that exact
crate with `--locked`, verifies the known empty vector, and keeps
product builds out of certification. Homemade or embedded BLAKE3
implementations are not used. `.github/workflows/ci.yml` is untouched.

This does not tag, publish, promote, bump versions, first-publish a
Windows runtime archive, or dispatch prepare-only / musl certification.

## Changes

- `workflow_dispatch` keeps `prepare_only` and optional `prepare_set`
(`darwin` | `musl`, default `darwin`).
- `prepare_only=true` with unset/darwin continues to build only the
Darwin pair.
- `prepare_only=true` with `prepare_set=musl` builds only
`x86_64-unknown-linux-musl` and `aarch64-unknown-linux-musl`.
- `prepare_set=musl` without `prepare_only=true` fails closed.
- Non-prepare (tag/nightly) matrix is Darwin + GNU + musl. Windows
remains out.
- `musl-certification` runs only for prepare-only musl, on
`ubuntu-latest` (x86_64) and `ubuntu-24.04-arm` (aarch64). It downloads
`binary-${{ matrix.target }}` from the same run by name and does not use
cross-run `artifact-ids` / `run-id`.
- The cert job installs the Rust toolchain
(`dtolnay/rust-toolchain@29eef336`, 1.95.0) and runs
`scripts/ci/setup_musl_certification.sh` so pinned `b3sum` 1.8.5 exists
before archive certification. It does not rebuild product binaries
(`cargo build`, `cargo check`, `cargo test`, `-p astrid`, or
`CARGO_TARGET_DIR` are forbidden in that job).
- `fskit-certification` and `github-release` remain skipped when
`prepare_only` is true.
- `scripts/certify_musl_release_archive.sh` requires executable members
`astrid`, `astrid-daemon`, `astrid-build`, `astrid-emit`, and
`astrid-storage-provider-fuse`; staged identity is the basename. It
fail-closes unless `b3sum` reports exactly version `1.8.5`, the known
empty vector
`af1349b9f5f9a1a6a0404dea36dcc9499bcb25c9adc112b7cc9a93cae41f3262`
matches, and staged bytes agree with the downloaded artifact via pinned
`b3sum` and system `sha256sum`. Runtime `b3sum` invocations do not pass
`--locked`.
- Check/test execution provisions the same real 1.8.5 binary through
`scripts/ci/setup_musl_certification.sh --b3sum-only` without editing
`ci.yml`.
- Musl images remain the existing official Rust 1.95.0 Alpine pins.
- `.github/workflows/release.yml` stays at 995 lines (`SRC_CAP=1000`).

## Verification

- Exact head `72690a08f2cc740cdc4a245c987a907cbcb47233`. Sole parent
`dc9ad36f8cebd937cf0ed15c3f3a87235fd56b17`. Tree
`f6f4b97b8f2450f5ead8921eb066c1666570202d`.
- `origin/main` `c057ff02d2f91a81dc0fc7f61d921cd2edf114c4` is an
ancestor. Rejected unpublished
`fb781397855f6b27797dd083842da0a4db538c1e` is not parent, ancestor, or
cherry-pick.
- Unique files versus parent:
  - `.github/workflows/release.yml`
  - `scripts/ci/setup_musl_certification.sh`
  - `scripts/test_certify_musl_release_archive_contract.sh`
- Unique files versus `origin/main` also include:
  - `scripts/certify_musl_release_archive.sh`
  - `scripts/ci/test-release-contracts.sh`
  - `scripts/classify_release_build_matrix.py`
  - `scripts/test_channel_workflow_contract.sh`
- GPG Good key `7CD32E7697286B11593246B9FA53358CB4127512`; matching DCO
present.
- Local: classifier 16-case matrix;
`scripts/test_channel_workflow_contract.sh`;
`scripts/test_certify_musl_release_archive_contract.sh`;
`scripts/ci/test-release-contracts.sh`.
- `git diff --check` clean; `release.yml` is 995 lines; `ci.yml` is
unchanged.

## Residuals and claim limits

- Source/workflow contract only. Do not dispatch prepare-only Darwin or
musl certification from this PR.
- Predecessor exact-head verdicts on `dc9ad36f` do not transfer.
- Does not produce or recover a Darwin `binary-<triple>` for native
FSKit certification.
- Does not land musl as a published 2026.9.0 inventory claim until
certification later succeeds on landed main.
- Does not implement a Windows daemon, merge draft #1814, or restore
Windows runtime archives.
- Does not bump, tag, publish, or close #1817 / #1818.

## AI / Tool Assistance

Assisted-by: Codex:zai-coding-responses/glm-5.3-flash

The prepare-only musl certification lane and this b3sum-provision
successor were authored with Codex assistance in an isolated worktree.
Exact SHA, unique file set, ancestry, signature, DCO, and local contract
tests were independently verified. Independent exact-head review is
required; this PR is not merge-ready on author evidence.

## Checklist

- [x] Linked to an issue
- [x] Changelog fragment skipped for this release-guard-only change; PR
is labeled `skip-changelog`
- [x] I understand every change in this PR and can explain its design,
risks, and validation.
- [x] I reviewed and tested the meaningful tool-generated output
included in this PR.
- [x] Every non-bot, non-merge commit has a matching `Signed-off-by`
trailer.

---------

Signed-off-by: Joshua J. Bouw <jjb@unicity-labs.com>