feat(release): version.txt base for bundle, required-image release posture, unified-lane docs (RIG-2916)

[rigel-mintaka]

The code half of T5 of the frozen compass-unified-release-lane design.
The tag-ruleset repoint half of T5 is a GitHub settings surface handled
in the T6 human-action issue, not here.

• app-bundle/build.sh: retarget the version base from the hardcoded
  0.1.0 to the root version.txt (release-please's source of truth),
  keeping the +g<shortsha> dev/bundle suffix (design §A2). After the
  first real bump a hardcoded base would silently report stale, and the
  SMOKE version-containment assert would keep passing against the wrong
  base. Read version.txt on its own line so cat is the sole (thus
  last) command substitution set -e inspects in the assignment — a
  composite v="$(cat …)+g$(git …)" swallows a failing cat because
  set -e only inspects the last substitution's status — plus a non-empty
  guard for a present-but-empty file. A missing/empty version.txt now
  fails loud (§A2 intent).

• tools/release-notes/index.ts: at RELEASE time a null container image
  is a hard failure, not a degradation — a published vX.Y.Z with no
  resolvable image violates the one-version-spans-the-product invariant
  (§A2). New pure, exported, unit-tested helper requireImageAtRelease
  beside classifyImageResult; main() throws on a release-time null
  image after gatherImage, before the expensive nix-outputs gather.
  The release-time signal is !dryRun (no new CLI flag): the tool's
  only real-write invocation is the release-assets job; --dry-run is
  the preview path. The pure assemble() core and classifyImageResult
  are untouched — the dry-run path still degrades to IMAGE_ABSENT_LINE,
  preserving the T3/T5 boundary. The --tag input is opaque passthrough
  (nothing parses its shape; assemble() only prints it), so the new
  semver vX.Y.Z tag flows through unchanged — documented, no code change.

• docs/architecture/build-and-ci.md: rewrite the "Publishing the agent
  image" section to the unified release.yml lane — the per-push
  publish-image job (:git- + :latest), the release-gated
  release-image job (digest-re-tags to :vX.Y.Z, same digest, no
  rebuild), and the release-please standing-Release-PR cadence. Points
  at the frozen record. The standalone publish-agent-image.yml still
  exists; its retirement is a separate follow-up (T4), so the prose does
  not claim it is deleted. The pre-merge-check inputs now correctly
  mirror the publish-image job's in-job changed-path gate closure set —
  release.yml carries no paths: trigger filter (release-pr needs every
  commit), so the job self-gates.

• docs/designs/platform/compass-unified-release-lane.md: two frozen-record
  amendments folded here because the slice already owns the unified-lane
  docs and platform is not a design-ledger-governed bucket (no
  touch-coupling / ledger delta applies). (1) Flip the Status: header
  Draft -> Active: the design PR (docs(platform): unified release lane — release-please + folded image publishing (RIG-1746) #736) merged = freeze, so the in-force
  contract is Active per the design skill; the header is sanctioned
  lifecycle state, not frozen content. (2) Correct the OQ-N1 bump-semantics
  erratum per Matt's RIG-2997 ruling: the frozen prose read feat: ->
  MINOR, contradicting the config it cites (bump-patch-for-minor-pre-major
  damps feat: to PATCH) — the self-contradiction RIG-2997 flagged. Matt
  ruled both feat: and fix: bump PATCH, a MINOR is a deliberate manual
  release-as in a separate PR. Config-as-built (T1, both flags) is
  already correct; only the prose changes.

Verified: bun test tools/release-notes/ = 22 pass / 0 fail (18
pre-existing + 4 new requireImageAtRelease cases); bash -n build.sh OK;
red-green proof that a missing/empty version.txt now aborts; biome +
markdownlint clean.

Spec-impact: OQ-N1 prose erratum only (config-as-built unchanged);
implements frozen §T5 code half; §A2 version.txt promise, previously
unowned, now realized.
Refs RIG-2916
Refs RIG-1746

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2916

RIG-1746

[github-actions]

Compass engineering docs preview: https://compass-native-rig-2916-t5-c.compass-eng-docs.pages.dev

Deployed from compass-native/rig-2916-t5-code at 64ca277.

Changed pages:

• docs/architecture/build-and-ci.md
• docs/designs/platform/compass-unified-release-lane.md