chore(release): prepare v0.25.0 beta-36

[jeremi]

Release identity

• Registry Stack v0.25.0
• Release train beta-36
• Based on protected main at f4f9df45c
• SemVer is minor because of one breaking change in adopter tooling, described below. No runtime API, manifest format, or product boundary moves.

Prepared surfaces

• Rust, Node, Python, OpenAPI, fuzz-lock, and generated-loader version identity
• Immutable beta-36 manifest, carrying the unchanged 51-entry identifier catalog digest from beta-35
• Product changelogs and v0.25.0 release notes
• Versioned docs docset, generated CLI reference, contract metadata, and archive identity
• Release-scoped docs expectation updates for the new candidate docset

The planner reports ready with 13 checks passed. The change set is 121 files,
the same surface set as the v0.24.0 preparation commit 622614672.

Why the minor version

The trace field of evidencectl fixtures run --json changes from a string
holding the text rendering of evidence evaluate --explain to that command's
structured JSON document. evidencectl is adopter tooling outside the frozen
Version 1 runtime contract, and the field only ever appears under --explain,
but a consumer reading trace as text must be updated.

Archive identity

The v0.25.0 archive lock is bound to the canonical Ubuntu 24.04 x86_64 build on
Node 22.12.0, the environment candidate construction uses. Pagefind's index
bytes follow the builder, so a digest recorded on another platform cannot match.

v0.24.0 needed a second commit (b2dc14c88) to correct this, because its first
snapshot predated the preparation commit and stagePinnedGeneratedArtifacts
resolved the unpublished candidate tag to a HEAD that still carried the
pre-bump CLI reference. This branch avoids that failure by construction: the
preparation commit was created first, the Ubuntu snapshot was taken with that
commit as HEAD, and the lock was amended into it. Three independent Ubuntu
builds agree on all three digests:

Build	Mode	HEAD	Result
Container, before the lock existed	--write-lock	eff46829b (pre-amend)	produced the three digests
Container, after the amend	--verify-lock	b9ca33062	identical, so the amend moved no bytes
Canonical CI rehearsal	--verify-lock	b9ca33062	passed

Verification

• Release planner: ready, 13 checks passed
• Release validators: validate release/manifests/registry-stack-beta-36.yaml, validate-current, validate-docsets, check:archive-lock --base-ref origin/main (31 archives), check-release-source-model.sh in monorepo mode
• Release test suite: 389 passed, 1 skipped, across all 19 release/scripts/test_*.py modules
• Gate inventory: 151 gates, and its 53 tests
• Product gates: 16 passed (Evidence 6, Relay V2 6, Discovery, identifiers, Manifest, platform)
• Evidence generated contracts reproduce exactly
• Docs tests: 364 passed, 0 failed. npm run check: passed, 18439 built links checked
• Cargo on the pinned 1.95.0 toolchain: fmt --check, check --locked --workspace --all-targets, clippy --locked --workspace --all-targets -- -D warnings
• git diff --check
• Canonical Ubuntu release rehearsal, all three jobs green, dispatched against this exact head: https://github.com/registrystack/registry-stack/actions/runs/32571901559

One local test failure, pre-existing and macOS-only

cargo test --locked --workspace fails five registry-mint tests on this
macOS arm64 machine:

server::tests::healthcheck_accepts_the_exact_ready_response_over_a_live_socket
server::tests::healthcheck_refuses_redirects_over_a_live_socket
server::tests::healthcheck_rejects_a_non_ready_response_over_a_live_socket
server::tests::healthcheck_rejects_a_truncated_response_over_a_live_socket
server::tests::healthcheck_rejects_an_oversized_response_over_a_live_socket

This is not caused by the release and is not load-related. The branch changes
zero files under crates/registry-mint and zero .rs files anywhere
(git diff origin/main...HEAD --name-only), and Rust tests (mint) is green
on the base commit f4f9df45c. Reproduced 3 out of 3 runs on an idle machine,
and once more with a single test selected and nothing else running.

The cause is a test budget tighter than the code it exercises.
healthcheck_against_raw_response wraps the call in
tokio::time::timeout(Duration::from_secs(1), ...), while healthcheck's own
HEALTHCHECK_TIMEOUT is Duration::from_secs(5). Each call builds a fresh
reqwest::Client, and the workspace pins reqwest with
rustls-tls-native-roots, so every build enumerates the platform trust store.
On Linux that reads one file; on macOS it queries the Security framework, which
costs about a second here. The request itself is plain HTTP to
127.0.0.1, so the trust store is loaded and never used.

Flagged rather than fixed: it is outside this change's scope, and a release
branch is the wrong place to change a service's test timing.

After merge

Merge this last. Between recording a lock entry and publishing the bundle, any
change under docs/site/src/content/** invalidates the candidate with no
supported repair, and sync-repo-docs.mjs flows products/*/docs/** into that
tree. The candidate should be dispatched immediately after the squash lands.