Owen Alpha release: publish and externally verify the first Owen.Cli package

[PhysShell]

Parent: #250
Blocked by: #252

Agent brief — tier: medium, owner-supervised. This issue performs the first real NuGet publication.

Goal

Publish the first public Owen.Cli alpha using the already-merged protected release workflow, then verify the package from clean machines and the public nuget.org feed.

Preconditions

• Owen Alpha gate: choose license, configure protected release environments, and approve version #252 completed.
• Root license and package metadata agree.
• nuget-release Environment has required reviewers.
• NUGET_API_KEY is configured as an Environment secret.
• The intended Owen.Cli version and tag are recorded.
• Owen.Cli availability is re-checked immediately before publication.

Release candidate verification

Before creating the production tag:

1. Run the release workflow's build/pack path.
2. Confirm exactly one .nupkg artifact.
3. Inspect package contents:
   • Owen.Cli package identity;
   • owen tool command;
   • README and license;
   • internal CLI/extractor assemblies;
   • complete vendored Python core;
   • no temp paths, source checkout debris, secrets or unintended build outputs.
4. Install the exact uploaded package on Ubuntu and Windows.
5. Verify:
   • owen --version;
   • owen --help;
   • leak sample → exit 1 + expected diagnostic;
   • clean sample → exit 0;
   • unsupported input → exit 4;
   • missing Python path → exit 3 with actionable text;
   • uninstall/reinstall cycle;
   • SARIF driver identity is Owen.

The smoke jobs must use the uploaded package artifact, not a checkout, project reference or rebuild.

Publication

1. Ensure main CI is green.
2. Create the immutable tag:

owen-cli-vX.Y.Z

3. Confirm the tag version exactly matches package metadata.
4. Approve the protected nuget-release deployment.
5. Publish once. Do not retry by overwriting the same version.

Public-feed verification

From clean Windows and Ubuntu environments with no repository checkout and no local package source:

dotnet tool install --global Owen.Cli --version X.Y.Z
owen --version
owen check <leak sample>
owen check <clean sample>

Also verify uninstall/reinstall and package upgrade behavior where applicable.

Failure/rollback policy

• NuGet versions are immutable.
• A broken published version is fixed by a new patch version.
• Deprecate/unlist only when necessary and document why.
• Never move or recreate the immutable release tag.
• Do not hide a failed public smoke test behind a local-feed success.

Guardrails

• No Rust cutover.
• No analyzer behavior change.
• No new diagnostic rule.
• No package publication through workflow_dispatch; only the protected tag-push path may publish.
• No secret exposure.

Acceptance

• Package is visible on nuget.org under the approved version.
• Clean Windows and Ubuntu installs succeed from the public feed.
• owen check produces the expected leak and clean outcomes.
• Public package metadata, license and command are correct.
• Immutable tag and package version agree.
• README quickstart is reproducible from a clean machine.
• Release evidence records workflow run, package URL/version, and public smoke results.