ci: publish the built DAR as a pinnable release asset - #155

Summary

Closes #143, #144, #145, #146, #147.

A downstream repository cannot depend on this project without reproducing the whole Splice vendoring flow, because the token-standard package ids have to match exactly or the DARs do not link. Publishing the built DAR removes that requirement: the artifact already bundles the six splice-api-token-* interface packages at the ids it was compiled with, so a consumer inherits them from the file instead of from a toolchain.
This branch builds everything publishing needs. Pushing the tag is #133 and stays open.

Changes

• consumer-smoke/: a package whose only dependency is a copy of the built DAR, driven by scripts/consumer-smoke.sh and npm run smoke. It stands in for a consumer with no build tree of ours to point at, and converts to all seven interface instances, so dropping an implementation breaks this build rather than a downstream one
• scripts/release-notes.sh: generates the release body from that same package, so the published instructions are extracted from a file that has to compile rather than transcribed. It refuses an untagged or dirty tree, a deps/ whose vendoring stamp does not match versions.env, and a snippet that disagrees with the DAR's own dalfs
• .github/workflows/release.yml: on a v[0-9]* tag push it refuses a tag main does not reach, asserts the pins, runs the suite, verifies the DAR is byte-reproducible from a re-vendored tree, runs the smoke test and publishes the DAR it verified. workflow_dispatch runs every step but the on-main refusal and the publish, so it cannot publish
• .github/actions/install-dpm: the download, its pinned digest and the SDK sweep, shared by both workflows so the digest has one home
• ci.yml: runs the smoke test and the release-body generator on pull requests, and adds three ungated comparisons that run whatever the change touches: template ids, the README consumer snippet against the smoke package, and every tracked daml.yaml against the SDK and LF pins
• README, RUNBOOK, ARCHITECTURE, SPEC and CLAUDE document both consuming a release and cutting one, including the two script knobs and the pre-release rehearsal

Acceptance criteria

• Prove the built DAR is consumable on its own #143 the smoke package compiles against a copied DAR, names a type from each of the six bundled packages, and removing the --package lines fails with exactly six hidden-package errors. Diverged: the copy is the version-free vendor/canton-token-forge.dar, so no version string sits in the consumer's config. Strengthened during review: it converts to all seven interface instances, since a type outlives the interface instance that mentions it
• Generate the release body from the consumer smoke test package #144 the body is generated from the smoke package's daml.yaml at run time and records the sha256, the main package-id, the SDK, SPLICE_TAG and the vendored Splice commit, all read from the files that hold them. Added during review: ALLOW_UNTAGGED=1 and SKIP_BUILD=1, both documented, and a two-directional check that the published flags
  match the DAR's own dalfs
• Publish the built DAR as a release asset on tag push #145 the workflow refuses a tag main does not reach, asserts the pins, runs the suite, proves byte-reproducibility, runs the smoke test, generates the body and publishes on a v[0-9]* tag push only. contents: write is confined to it and the checkout does not persist its token
• Document consuming and cutting a release #146 README covers consuming, RUNBOOK covers cutting, and ARCHITECTURE, SPEC and CLAUDE list the new package, scripts and commands. No em dashes in the diff
• Run the consumer smoke test on pull requests #147 a pull request that drops a --package line, or that drops a bundled interface out of the DAR, fails the daml check. Diverged: criterion 2 said the step goes inside the existing scope gate, but that gate listed none of the paths criterion 3 names, so the gate was widened to consumer-smoke/ and scripts/consumer-smoke.sh. Criterion 4 was already satisfied by the ungated SDK-pin sweep

Test plan

Automated tests

The smoke package is itself the new test: npm run smoke builds the DAR and compiles a consumer against it. npm run build, npm test (80 scenarios) and npm run smoke are green on this branch, and CI runs the smoke step, the release-body generator and the three ungated comparisons on every scoped-in pull request (daml 1m49s on the last head).

Manual verification

Every guard was driven red before it was written, locally and in throwaway clones: a reordered daml.yaml block, a deleted --package line, a flag the DAR does not bundle, a bundled package the snippet stopped naming, a dirty tree, a tag that names another commit, a tag main does not reach, a second --target entry, a manifest with no version, a DAR carrying two package-ids, a README snippet with its block header renamed, and gh argv shims over all four publish paths. Each documented command was run verbatim from the directory its doc names, including its failure mode. The release workflow itself has never executed: the dispatched dry run is the first step of #133.

Breaking changes

None.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.