feat: harden post-alpha release and prepare beta channel

[alphastorm]

Decision

Review-only post-alpha and beta-readiness work package. Do not publish a beta from this PR alone.

The published v0.1.0-alpha.1 boundary remains unchanged. The exact tested OMP v17.4.1 patch route is the accepted beta prerequisite: upstreaming discussion #6460 and paired OMP packaging are not beta blockers, while stock OMP remains insufficient.

Changes

• rebase the six-commit controller/registry patch onto exact OMP v17.4.1 / 9350b799…, with matching pi-wire, provenance, licenses, doctor pinning, and hosted apply lanes;
• document and exercise a versioned Linux/macOS route from exact checkout → git am tree assertion → upstream bun setup/binary build → separate omp-gateway-patched activation/config verification → symlink rollback;
• add a closed fail-safe beta channel: v<version>-beta[.<n>] maps only to OMP_RELEASE_CHANNEL=beta; stable/RC/property-name inputs are rejected; only release-info.json changes across channels and the SBOM stays byte-identical;
• scope managed-service readiness to 60 seconds on Windows only, retaining 15 seconds elsewhere;
• add deterministic synthetic README media, capture/verification, product-first README, alternatives matrix, and draft launch copy;
• record the protected 28,800-second relay run and persistent Windows source acceptance without advertising Windows;
• keep Android radio recovery, Windows, Portal/self-hosted relay, and paired packaging as disclosed limitations or post-beta work—not hidden beta gates.

Security / support impact

• No capability transport or persistence boundary is widened.
• Stock or loosely versioned OMP is explicitly unsupported; participating processes must use the verified patched binary.
• Release-channel promotion is closed and fail-safe; beta is not stable or production-qualified.
• Windows remains unadvertised and starts at interactive login only.
• Media uses seeded synthetic data and structurally checks textual metadata without treating compressed codec bytes as text.

Verification

• bun run check: 389 passed, 0 failed; 2,009 assertions; all workspace typechecks, production build, handoff validation, capability and identifier leak scans green.
• Beta release tests: 6 passed, 131 assertions; default/pre-alpha/alpha behavior retained, beta archive delta limited to release-info.json, channel-independent SBOM.
• bun run media:check: passed. bun audit: no vulnerabilities.
• Exact OMP patch: pristine git am reproduced tree a5cfc80f…; 122 focused macOS tests and ci:check:full passed.
• Versioned patch route smoke: built omp/17.4.1, installed through the separate symlink, and persisted collab.autoStart=control plus registryEndpoint=auto.
• Windows source evidence remains supplemental: publisher 13/13, patched binary publication, 200 no-store View/Control, stale 409, 374 ms forced-exit revocation, and doctor 17/17.
• Protected relay: 28,800 seconds, 22 transitions, final live, exit 0, no restart.
• Cross-family focused review of the substantive post-alpha set: no findings or unresolved items.

Actual remaining beta gates after merge

1. Cut a signed beta candidate from protected main and verify checksums, GitHub attestations, Cosign bundles, and exact archive bytes.
2. Re-run the signed candidate lifecycle on advertised Debian 13 x86-64 and macOS 26.6.1 arm64.
3. Re-run the physical Pixel install/discovery/View/Control/interrupt/revocation/BFCache/leak/attention smoke against sessions launched from the exact v17.4.1 patched tree.
4. Run a bounded real default-relay smoke. The completed protected eight-hour soak is reusable because collab-web/wire protocol bytes are unchanged.
5. Reconcile the final ledger/compatibility/release notes, then make an explicit beta publication decision.

Not beta blockers: upstream discussion #6460, paired OMP packaging, Windows support or its Windows-only read-only fixture hang, Android/Chrome issue #65, Portal Tunnel #74, draft Windows ACL optimization PR #91, self-hosted relay, and aggregate coverage percentage.

[codecov]

Codecov Report

❌ Patch coverage is 78.33333% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.05%. Comparing base (94ec8ea) to head (9575c2c).

Files with missing lines	Patch %	Lines
apps/gateway/src/cli.ts	66.66%	10 Missing ⚠️
scripts/build-release.ts	89.28%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #121      +/-   ##
==========================================
+ Coverage   69.87%   70.05%   +0.17%     
==========================================
  Files          30       30              
  Lines        6567     6605      +38     
==========================================
+ Hits         4589     4627      +38     
  Misses       1978     1978              

Files with missing lines	Coverage Δ
apps/gateway/src/doctor.ts	77.34% <100.00%> (ø)
scripts/build-release.ts	67.59% <89.28%> (+0.87%)	⬆️
apps/gateway/src/cli.ts	30.80% <66.66%> (+3.72%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.