[dhruv8sh]

Summary

• Adds the design spec for Build ts CLI binary for tagged releases #863: pushing a v* tag builds the ts CLI and publishes .deb (Ubuntu), .rpm (Fedora), .pkg.tar.zst (Arch), and macOS .tar.gz packages for x86_64 and arm64 to a GitHub Release. Each package is smoke-tested before anything is published.
• Settles the open decisions in Build ts CLI binary for tagged releases #863. The supported targets are Linux and macOS on x86_64 and arm64. Integrity comes from SHA256SUMS plus build provenance attestations.
• Creates the release.yml that Publish attested release binaries with build provenance and SBOMs #1235 will extend, following Publish attested release binaries with build provenance and SBOMs #1235's constraints: actions pinned by SHA, GitHub-hosted runners only, --locked builds, and a draft release that is published only after every asset is uploaded. SBOMs and the attested wasm stay with Publish attested release binaries with build provenance and SBOMs #1235.
• Adds the task-by-task implementation plan. The implementation will be a separate PR stacked on this one.

Changes

File	Change
docs/superpowers/specs/2026-10-12-863-cli-release-packaging-design.md	New spec: trigger and versioning, build matrix, nfpm packaging, smoke tests, publish, permissions, failure handling, dry-run testing
docs/superpowers/plans/2026-10-12-cli-release-packaging.md	New implementation plan: release helper scripts with tests, nfpm config, release.yml, CONTRIBUTING.md release section

Closes

Refs #863. The implementation PR will close #863, so merging this spec doesn't close it early.

Test plan

• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• Docs format: cd docs && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: Prettier check (docs/.prettierrc) on both changed files. This PR is docs only, so no Rust or JS gates were run.

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests
• No secrets or credentials committed

Before the first release

• CHANGELOG.md already lists [1.2.0] but the workspace version is 0.1.0. The first tag needs a version newer than both.
• Turn on immutable releases and add a tag ruleset for v*, as Publish attested release binaries with build provenance and SBOMs #1235 asks.

[aram356]

Related to #1262

[dhruv8sh]

Closed since #1262 already implements this