First release prep: Quint spec review, test parity, and release pipeline validation

[abienkowski]

Summary

Tracking epic for all work required before publishing the first official release of docker-socket-policy. The repo currently has 6 draft releases (v0.2.1–v0.2.6) auto-created by release.yml on every push to main, none of which have been published.

Definition of Done

A tagged release is published with:

• Go, Rust, and TypeScript binaries/archives attached
• SPDX + CycloneDX SBOMs (syft) for all three Docker images
• Cosign signatures on all three Docker images
• Release notes generated and curated
• Quint spec verified and matching all three implementations

Checklist

• Quint spec review: verify invariants map to implementation behavior #5 Quint spec review — every invariant maps to real guard/mutator behavior in all three implementations
• Draft releases cleanup and versioning strategy #6 Draft releases cleanup & versioning strategy
• Test parity audit across Go, Rust, and TypeScript #7 Test parity audit across Go/Rust/TypeScript + integration
• Release pipeline validation: SBOM, signing, draft to publish #8 Release pipeline validation (SBOM, signing, draft→publish)
• Reproducible-build release gate (StageX) #9 Reproducible-build release gate
• CHANGELOG and README polish for first release #10 CHANGELOG + README polish

Which implementation(s) would this affect?

• Go
• Rust
• TypeScript
• Quint specification
• All

Additional context

• Release workflow: .github/workflows/release.yml (auto-bump patch on push to main, draft release, syft SBOM from Docker images, Cosign signing)
• CI: .github/workflows/ci.yml (quint, go, rust, typescript, integration, reproducible-build)