Publish paired Go tags and add recovery conformance

[bigboateng]

Boundary

This change crosses the stable-release ref boundary and the Program-identity recovery boundary. One stable source must become visible under the repository tag and nested Go module tag together, while unresolved durable work may be settled only by the exact Program identity that created it.

Transition

Before this change, stable automation published only vX.Y.Z, leaving the nested Go module without its required boatstack/vX.Y.Z ref, and the public suite had no end-to-end law for cross-Program unresolved recovery. After this change, automation derives both tags from the same verified source, refuses conflicts or source/main movement, and sends both annotated refs in one non-force atomic push; only the root tag still triggers the GitHub Release. The exported conformance case proves that a different Program cannot resolve or apply the original or recovery prescriptions, then proves that the original Program can reopen and settle once without duplicating the first effect. The documentation keeps the checksum CLI installer separate from Go embedding and treats remote module resolution as unavailable until a paired release is published.

Evidence

The isolated release tests use temporary source and bare repositories to verify same-source annotated tags, root-only version calculation and GitHub Release triggering, and zero partial remote refs for existing-member, mismatched-target, source/main drift, and rejected-push cases. The kernel regression tests bind the domain-contract fingerprint into Program identity, observe zero state, effect, receipt, commit, or verification change under the wrong Program, and observe one recovery settlement under the original Program. A clean temporary consumer with GOWORK=off imports kernel and kernel/conformance through a local replacement, proving the checked source surface only. Local assurance passed all 661 sharded Go tests, go test -race ./kernel/..., go build ./..., go vet ./..., all 81 Python contract tests, 32 Flow SDK tests, the documentation build/check, release-note preflight, and git diff --check.

Commits

• feat: publish paired Go module tags
• Seal converged self-review attestation

Self-review attestation

• reviewed tree: 95b93fceaa40213ef42678c0e46c47207671ff31
• program fingerprint: 3ca3397ff275d89bdb6d5c934b86b51d3cbdfab0ee628c47fe94d1d4f5767155
• the review-verified CI job re-derives both facts deterministically from the base-admitted policy