Complete release and helper download safeguards

docs/CODE_SIGNING_POLICY.md

@@ -74,9 +74,11 @@ Normal stable publication and stable dry runs select `signpath` directly.
 - Release checksums and detached signatures are published alongside artifacts
   and verified independently after publication.
 - Release activation requires GitHub CLI 2.97.0 or newer, which includes the
-  literal signer-identity matcher fix. The published checksum manifest must
-  carry build provenance from the exact `create-release.yml` workflow and
-  release source commit; repository-level provenance is not sufficient.
+  literal signer-identity matcher fix. The shared
+  `scripts/require-safe-gh-attestation.sh` guard enforces this floor. The
+  published checksum manifest must carry build provenance from the exact
+  `create-release.yml` workflow and release source commit; repository-level
+  provenance is not sufficient.
 - Every new release is assembled and validated as a draft. Its activation
   marker is uploaded and digest-checked before publication; GitHub must then
   report the published release as immutable, protecting its tag and complete

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -4522,3 +4522,10 @@ the customer-promotion lease or mutate a floating image tag, Helm index,
 paid-runtime pointer, or live environment until the check passes. Repository
 release immutability must therefore be enabled before merging or running this
 activation path.
+
+Attestation policy decisions require GitHub CLI 2.97.0 or newer so signer
+repository and workflow names are matched literally. The shared verifier must
+also bind the downloaded `checksums.txt` bytes to the immutable release and to
+SLSA v1 provenance from the exact `create-release.yml` workflow and expected
+source SHA. Multi-asset download retries clear both the activation marker and
+checksum manifest first so a partial attempt cannot poison every later retry.