docs(release): record v0.3.2 publication

[davidahmann]

Outcome

Records the completed v0.3.2 release evidence after the immutable package, tag, and GitHub Release were verified. This changes no package, tag, workflow, or distribution channel.

Changes

• Add candidate, protected publication, source identity, artifact digest, registry provenance, support-tuple expiry, GitHub Release, and npm channel readback to the v0.3.2 release record.
• Close the approved release task with the exact run, release, and integrity identities.

Acceptance and scenarios

R032-05 is complete: the tag, candidate, protected OIDC publication, independent verification, registry requalification, normal GitHub Release, and alpha/latest pointers resolve to the preserved v0.3.2 artifact.

Validation

• npm run format:check
• npm run schemas:check
• node dist/cli.js --json --cwd . audit bound to a7f09f303bff08da4410fd6b17470ffb8f92a860 / 5f6118fe230c46e35dcd12c307d895042b064f14
• Provider readback: npm alpha and latest both resolve to 0.3.2; GitHub Release 385751369 is public and normal; downloaded release tarball matches sha256:cdb123740e57562c81f6557d1ba7dfac2e243616f6e639bac1620166955bdf15.

Risk, authority, and residual limitations

The closeout preserves the public-alpha limits and records evidence only. It neither rebuilds nor republishes the artifact and does not change release policy.

Assistance disclosure

• Agent-assisted work is disclosed where applicable.
• Commits include DCO sign-off.
• No credentials or private execution evidence are included.