Public-safe CI and release lanes

[mathaix]

Goal

Create CI and release lanes that are safe for a public Apache repo and useful for local/operator users.

Rubric gates

• Public CI runs lint/static checks and unit tests without privileged KVM access.
• Privileged Firecracker/KVM tests are gated to trusted code paths only.
• Release artifacts are defined for CLI, backend, worker, rootfs/openclaw runtime assets where applicable.
• make preflight and CI commands agree.

Starting points

• .github/workflows/
• Makefile
• scripts/
• rootfs/
• versions.json

Expected output

• CI workflow updates for public-safe checks.
• A documented KVM integration lane that does not run arbitrary public PR code on privileged hosts.
• Basic release documentation or scripts for public artifacts.
• No private deployment credentials or hosted promotion scripts in public CI.

Non-goals

• Do not wire public PRs to OVH, claude-swarm, production Cloudflare, or production GCP.
• Do not publish releases until the overlay-boundary scrub passes.

[mathaix]

Status update after CI and branch protection setup.

Done:

• Public CI runs on GitHub-hosted runners for PRs and pushes to main.
• Static Checks and Unit and Type Checks are green and are now required for protected main.
• main is protected: PR required, one approving review required, branch up-to-date required, conversation resolution required, admin enforcement enabled, force push/delete disabled.
• KVM integration workflow exists and is gated away from public PRs. It runs only on trusted main pushes or maintainer workflow_dispatch with an exact PR SHA.

Still open:

• KVM runner start/stop secrets are not configured yet, so the KVM workflow intentionally fails at the hook step.
• The release-artifact side of the issue is not fully done; public artifact release definitions/scripts still need review.

Leaving open for KVM runner wiring and release lane completion.