[Track] Security hardening and signed release artifact chain

[SMC17]

Goal

Reduce agent-access and supply-chain risk with explicit release controls.

Deliverables

• Signed release artifact plan and verification steps.
• Policy for privileged automation actions and required review gates.
• Extend security gate coverage where risk is known.

Acceptance

• Security docs define mandatory controls for release and automation.
• Gate E evidence reflects enforced controls and trend thresholds.
• No production-oriented claim without provenance-compatible artifacts.

Linked Epic

• [Vision Epic] Agent-native XRP Ledger daemon in Zig: execution program #4

[SMC17]

Child delivery queue: #25 (expert-only), #26 (good first issue). Suggested order: #26 -> #25.

[SMC17]

New child issues for this track: #39 (Gate E artifact contract checks), #40 (signer key rotation drill runbook). #25 and #26 are complete.