Establish a CI system to enable reproducible, verifiable releases/artifacts

[stshrive]

Artifact releases need to be reproducible, verifiable, and automated. A robust CI/CD for release should consider:

• Dependency and asset tracking
• Code and artifact signing and verification (provenance)
• Artifact publication and consumption
• Guardrails (testing and contract validation)

Proposal: Agent Substrate Release Pipeline.

[BenTheElder]

Reproducible builds are pretty easy for Go these days but we're probably going to have some other artifacts that are not so easy, microVM assets (maybe a secondary repo), and the rust bits.

I think reproducible is a nice to have, secure community pipeline is more important

[stshrive]

I think you're right about the Golang context. That being said, the big ticket items are more like code and artifact signing decisions, and getting SBOMs for verification. I added the proposal to the issue for review.