Harden OSS release and maintenance workflow

[WahuVN]

Summary

Hardens ProofDrift's public OSS/release workflow for the 0.0.2 preview.

• synchronizes all workspace packages at 0.0.2
• pins third-party GitHub Actions to reviewed full SHAs
• fixes MSRV installation so Dependabot cannot mistake Rust 1.89 for an action version
• adds a self-contained ProofDrift composite-action smoke test
• automates platform archives, SHA-256 checksums, SPDX JSON SBOM generation and GitHub build-provenance attestations for tags
• adds changelog, roadmap, support, governance and release-maintenance documentation
• strengthens contributor/security documentation without expanding the claimed enforcement boundary

Local verification

• rustfmt: PASS
• clippy --locked --workspace --all-targets -- -D warnings: PASS
• workspace tests: PASS
• locked workspace release build: PASS
• proofdrift --version: 0.0.2

The production MCP stdio/HTTP transport and L2 isolation remain explicitly unclaimed.

[Copilot]

🟡 Changes recommended

The release workflow contains a Bash portability issue (${GITHUB_SHA::7}) that can break manual packaging runs on macOS runners.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens ProofDrift’s OSS release and maintenance posture for the 0.0.2 preview by synchronizing workspace versions, strengthening CI/release automation (including attestations/SBOMs), and adding/refreshing public-facing governance/support/security documentation.

Changes:

• Synchronize workspace crates to version 0.0.2 and update Cargo.lock.
• Harden GitHub Actions workflows and the composite action (pinned SHAs, explicit toolchain selection, release packaging + SBOM + provenance attestations, and an action smoke test).
• Add/expand OSS maintenance docs (support policy, roadmap, governance, releasing, changelog, contributor and conduct guidance).

File summaries

File	Description
SUPPORT.md	Adds support policy and platform support matrix.
SECURITY.md	Adds supported-versions guidance and links to support policy.
ROADMAP.md	Introduces a roadmap and 1.0 readiness criteria/non-goals.
RELEASING.md	Documents the tagged-release process and verification steps.
README.md	Expands project positioning, install guidance, and action usage snippet.
integrations/github-action/README.md	Documents composite action usage, outputs, and modes.
integrations/github-action/action.yml	Adds Rust installation step and exposes report-path outputs.
GOVERNANCE.md	Adds governance/decision model and maintainer responsibilities.
crates/proofdrift-secrets/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-schema/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-scan/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-runtime/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-registry/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-provenance/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-policy/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-patch/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-mcp-proxy/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-evidence/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-discover/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-core/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-capabilities/Cargo.toml	Moves crate versioning to workspace version.
crates/proofdrift-attest/Cargo.toml	Moves crate versioning to workspace version.
CONTRIBUTING.md	Expands contribution expectations and development requirements.
CODE_OF_CONDUCT.md	Expands conduct expectations and enforcement language.
CHANGELOG.md	Adds changelog entries for 0.0.1 and 0.0.2.
Cargo.toml	Bumps workspace version to 0.0.2.
Cargo.lock	Updates locked crate versions to 0.0.2.
.github/workflows/security.yml	Pins actions, installs toolchain explicitly, and locks clippy/tests.
.github/workflows/release.yml	Adds multi-platform packaging, SBOM, checksums, and attestations.
.github/workflows/ci.yml	Pins actions, fixes MSRV install semantics, and adds action smoke test.
.github/ISSUE_TEMPLATE/bug_report.yml	Updates bug report version placeholder.
.github/dependabot.yml	Removes BOM and adjusts update policy (incl. major updates).

Review details

• Files reviewed: 31/32 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.