[P0][Sprint 1][Release] Publish Sheets 1.3.1 cache isolation and certify the Marketplace install

[karlwaldman]

Why

Marketplace still serves Apps Script v11/runtime 1.2.2, while main is 1.3.1 and includes the spreadsheet/credential cache-isolation fix. The fixed code is not yet represented by an immutable Apps Script version or clean installed-add-on smoke.

Acceptance criteria

• Cut an immutable Apps Script version from exact current main.
• Smoke two spreadsheets with distinct keys/entitlements and prove no cached result crosses spreadsheets.
• Verify key replacement and entitlement upgrades invalidate negative caches.
• Install from a clean account through Marketplace and test key lifecycle, PRICE, INFO, GET, history, futures, rig, and bunker paths.
• Select the proven version in Marketplace.
• Record commit, Apps Script version, timestamps, redacted screenshots, and execution-log review.
• Tag/create a matching GitHub release.

Delivery

Independent of the Rails/web release train. Implementation issue #33 is closed; this ticket owns release certification only.

[karlwaldman]

Release-candidate update (2026-09-04):

• Repository maintenance/runtime PR chore: clear audits and restore Sheets attribution #39 merged as a1b2f23dda0874368ef2a0dde0cdb8f21f781ef7; all audits and the full 98-test/deploy-package/asset/portfolio/secret gate passed on PR and main.
• Governed release workflow https://github.com/OilpriceAPI/google-sheets-addin/actions/runs/33872286367 pushed the four reviewed runtime files from that exact commit and created immutable Apps Script version 13 at 2026-09-04 12:21 UTC.
• GitHub prerelease/tag: https://github.com/OilpriceAPI/google-sheets-addin/releases/tag/v1.3.1
• The candidate sends tested X-Api-Client: oilpriceapi-google-sheets and X-Client-Version: 1.3.1 headers. The usage review could only establish a generic Apps Script upper bound of 13,997 requests / 43 accounts over 7 days because public version 11 does not provide separable attribution.
• Receipt PR docs: record Sheets 1.3.1 immutable candidate #40 is merged; post-merge validation and GitHub Pages deployment are green.

Marketplace was not changed. The public listing remains on Apps Script version 11/runtime 1.2.2.

Remaining release blockers are the customer-runtime checks that cannot be proven by repository CI: clean-account Marketplace install of version 13; two spreadsheets with distinct keys/entitlements proving no response or negative-cache crossover; key replacement and entitlement-upgrade recovery; PRICE/INFO/GET/history/futures/rig/bunker coverage; redacted screenshots; and Apps Script execution-log review. Select version 13 in App Configuration only after those receipts are attached here.