[task #93] Add immutable Kuikly Raft release set

[bytemain]

Exact source

• head: 0871f2ffd5592b6bcf8ab04e1d62109c23602855
• base / sole parent / live staging3: b9051d9bfcb326bb24fb1c59fad11d1b1394fd8d
• tree / conflict-free synthetic merge tree: 64e416ba57687ce2e27e95f395bbc07bf8ffe518
• stable patch-id: 81a72ee3dacb94e173ace081fa1ff08d2c992f5e
• one BiSheng DCO commit; 25 paths (+6573/-176)

Summary

• stage the exact 37-coordinate Kuikly 2.24.0-raft.1 product graph across Linux, macOS, iOS and OHOS producers
• add the real core-annotations-android Android publication as the 37th seed, preserving its original GAV and POM/module/AAR/sources shape with all checksum sidecars
• validate Gradle-generated and renderer POM provenance with separate strict profiles: physical/declared GAV, exact source SHA/tag, botiverse connections, and the producer-specific browse URL shape
• derive dependency types from the real 37-seed primary-kind index before checksum/provenance sealing: the 19 owner POM edges contain exactly two AAR targets and 17 non-AAR targets
• require the two owner AAR dependencies to declare exactly one <type>aar</type>; forbid AAR typing on every non-AAR owner edge
• validate all 25 Kotlin Multiplatform metadata-member redirects against explicit same-plane/same-version owner roots and canonical Gradle Module Metadata URLs
• validate every immutable primary, optional signature and mandatory checksum sidecar; exclude mutable artifact-level Maven metadata from the immutable release set
• build iOS and OHOS renderers in disposable exact detached worktrees; safely validate the real OHOS gzip-tar HAR and its exact root manifest/native SO
• use fresh Gradle 7.6.3 POM-only resolution as the complete Android runtime graph gate
• use fresh Maven 3.8.7 only as an owner-edge gate: exact owner POM/AAR bytes, zero owner JAR request/fallback/cache and zero unresolved owner coordinate; preserve any raw external-boundary failure without calling it a full Maven pass
• publish only through the separately gated repository-scoped token after landed-source, predecessor, exact-byte conflict, full anonymous readback and completion-locator-last gates

Local validation

• current Python and CPython 3.8.20: 54/54 PASS each
• identical generated contract closure: 37 seeds / 880 files / set SHA-256 e3f1c65fd877aa9c096704df885b93f74e717a6cfb5d69a0f4812cc6d2790492
• causal mutations: 53/53 exact head/tree marker-bound RED with the complete 54 tests per arm; zero survivor/INVALID_RED; restored 54/54 GREEN
• exact real normal-linux producer: 12 seeds, 52 primaries, 208 checksum companions; 37th POM/module/AAR/sources SHA-256 82d7b9b1… / c9a9822a… / 7ed4f40f… / 4d13771c…
• fresh Gradle 7.6.3: FULL_GRAPH_SUCCESS
• fresh Maven 3.8.7: OWNER_EDGE_CLOSED / EXTERNAL_TRANSITIVE_DIAGNOSTIC, raw exit 1, fullGraphPass=false, zero owner JAR/unresolved/override; exact external set androidx.annotation:annotation-experimental:jar:1.4.1 and androidx.profileinstaller:profileinstaller:jar:1.3.1
• shell/Python/YAML/DCO/source cleanliness/merge tree/git diff --check: PASS
• immutable local report SHA-256: e768f3f7b24a628a69af1d6887656d125bef8c2fa08f41cc2b5e07426af5f7d5
• immutable local raw archive SHA-256: 63e1eb1dfd88ee9ed4052fbc9efc28dd4170751ac14267edb877b65e2384400c

Fresh Hosted gate

Fresh standard and dedicated runs on this exact are required to reproduce the
full identity/source matrix, 54-test contract, 53-arm mutation/restoration,
all five real producers, final 37-seed/880-file assembly, the 37th publication's
20 versioned objects, Gradle full graph, Maven owner-edge diagnostic with raw
nonzero, official candidate/runtime manifests and final no-drift. Run IDs are
recorded only after dispatch and exact-head readback.

Holds

This PR remains Draft. ed04a2df…, 5d3be391…, every earlier exact, run,
artifact and evidence packet are permanently diagnostic with zero inheritance.
No task #127, independent review, tag, token injection, PUT/publication,
completion locator, Mobile consumer change, carrier, Ready, merge or release is
authorized. Those remain withheld until both fresh Hosted runs are terminal and
their official artifacts are independently read back on this exact.