Release record R2: draft notes and owner, release modes, sign-off

[jfillman]

What

R2 of the Release Record work. This needs jfillman/backstage#136 for its routes.

• Notes and owner editor on the Next release card:
  • Keep a Changelog sections, known issues, rollback notes, owner and risk.
  • "Fill empty sections from the merged PRs" pre-fills notes from the scope.
  • Saving is a direct commit to glidepath/releases/next.yaml in the app repo. The record takes the draft when the release reaches Flight.
  • Readiness gains three checks: release notes, release owner, and sign-off (Hand-flown only).
• Release mode bar: Hand-flown, Assisted, and Autoland (shown, not available yet). Admins change the mode through a PR to the platform-owned release-modes.yaml.
• Record detail: a "Release notes and sign-off" panel
  • It shows the sealed notes and the sign-off on the production release PR, taken from the record or else read live.
  • The confidence score's approval points now come from sign-offs that count: before the merge, and not by the merger.
  • Human-context approvals are relabelled as acknowledgements after release and earn nothing.
  • The HTML/PDF export carries both.
• Masthead fixes (from your review):
  • The app name moves into the kicker. It read as part of the title next to the release name.
  • The full image reference and digest now show. When the image isn't live anywhere, the reference comes from the record's imageRepo.
• Docs: docs/release-records.md (modes, sign-off, draft) and the permission table in docs/security.md.

Verified

• tsc, lint and yarn ratchet are clean. All 794 tests pass, including new tests for the editor, mode bar, sign-off panel, note suggestions and the readiness checks.
• Live in the local harness against kind-prod and kiac-dev, with backstage#136:
  • The mode bar shows Assisted as the platform default.
  • The draft editor is read-only for a guest.
  • Readiness lists release notes and owner.
  • boarding-api 1.1.3's prod PR Full annotated values view in the values form #33 (merged by jfillman, no reviews) reads as "shipped without sign-off", neutral because the app is Assisted.
  • The masthead shows ghcr.io/jfillman/boarding-api:1.1.2-f59127c for a superseded record.

Not exercised live

These were left out on purpose, because they make real commits and PRs:

• Saving a draft
• Changing a mode
• A Hand-flown release

They're covered by unit tests on both sides.

🤖 Generated with Claude Code