Add reviewed private-source LSP release handoff

[AlexMikhalev]

The current LSP source is private, while extensions need public downloadable binaries. The existing publisher intentionally refuses a private source SHA that is absent from the public tag history. This change adds an explicit provenance handoff rather than weakening that guard or mirroring private history.

A protected, isolated producer checks the exact private tag, required Gitea CI and build-recipe hash, qualifies and builds six raw binaries, and emits only allowlisted files and sanitized receipts. A separate reviewed handoff pins the immutable artifact and producer run/attempt. The public tag publisher validates those bytes and retains the existing immutable draft/resume and anonymous readback behavior. The same-source helper is unchanged from its reviewed implementation.

Validation: 84 public contract/schema/real Git/files/ZIP tests passed; three workflow actionlint checks and Ruff F checks passed. An independent reviewer also verified the five private recipe tests and real Git credential-prompt canaries. Credential-host matching and malformed-metadata findings were fixed before this PR. Static scanner heuristics were reviewed; no open code findings remain (confidence 4/5, bounded to this framework).

Actual execution is intentionally still gated: the dedicated read-only source/registry bindings and lsp-private runner group with selected-workflow and OS-account isolation have not been verified. The two protected environments have now been configured and freshly read back: lsp-producer allows only main (branch), and lsp-releases allows only terraphim_lsp-v* (tag). The group metadata API probe returned HTTP 403. Subsequent authorized UI setup created group lsp-private with the exact producer workflow allowlist, but it currently has zero repositories and zero runners, with public access off. OS isolation, permitted repository access and source credentials remain gates. This PR includes no real source request, tag, artifact or release, and does not claim six-target compilation or released-host qualification. Internal rc.3 already identifies an older build; a new version must be checked across release hosts before use.

The paired private build-recipe PR is Gitea #3491; no private source history is included here. Refs private tracking issue #3488.

After the normal merge, the public release-contract workflow and documentation deployment passed. All 14 merged public files were anonymously read back against the independently reviewed hashes; the five private recipe files also match. A pre-existing Sentrux workflow YAML error still produces a separate zero-job failure and is unchanged by this PR.

[github-actions]

Documentation Preview

Your documentation changes have been deployed to:
https://2f490bd7.terraphim-docs.pages.dev

This preview will be available until the PR is closed.