release: consume and publish ecosystem compatibility BOM evidence

[codeforester]

Goal

Make the Base demo release workflow consume the ecosystem BOM and publish its validated row/evidence.

Background

Parent: basefoundry/base#2115. Every Base release and demo release must expose one reproducible compatibility record rather than leaving pins and results distributed across workflow YAML and prose.

Scope

• Declare the base-demo release metadata, API/schema contract, and supported platform/runtime.
• Validate the exact Base, base-cli, and base-bash-libs pins used by the release workflow against the BOM.
• Publish the demo row/evidence and BOM digest as a release artifact when the demo release is prepared.
• Fail the release gate for missing, mutable, mismatched, or failing required combinations; leave development/moving-source rows advisory.
• Document the maintainer rehearsal path for the next demo release.

Acceptance Criteria

• A deterministic demo BOM row is generated from explicit release inputs.
• The row records exact full commits/tags, contract identity, platform evidence, result, and artifact provenance.
• The current pinned combination can be rehearsed successfully without publishing a release.
• Existing ./tests/validate.sh and release checks remain green.

Non-Goals

• Do not publish a new demo release in this issue.
• Do not replace repository-local release policies.
• Do not require every moving-source branch to be compatible.

Project Fields

• Status: Backlog
• Priority: P1
• Area: CI
• Initiative: Adoption Polish
• Size: M

Agent Assignment

• Assignee: codeforester

Parent: basefoundry/base#2115

[codeforester]

Implementation is in PR #282: #282. Release/BOM Bats tests pass; full validation is blocked by the existing Node 14 installation while this repository requires Node 20.19+ or 22.12+. Project status remains In Progress pending the hosted checks.