Niro v0.1.55

Summary

This release supersedes the quarantined v0.1.54 release, corrects stable build
version metadata, and delivers the documented Community Edition release
process and stable, dev, and release-candidate installation channels.

Changes

• Pinned stable GoReleaser builds to the triggering tag when a source commit
  also carries a prerelease tag.
• Added a pre-publication check that requires GoReleaser metadata and the built
  CLI's own version output to match the stable release tag exactly.
• Made stable image recovery validate release-note policy and the authored note
  from reviewed main, so the previous stable tag can be restored safely even
  when its older source tree predates the recovery workflow.
• Added explicit Community Edition support, security-reporting, release-note,
  and artifact-verification guidance.
• Added a dedicated dev/RC workflow that builds version-matched CLI and
  attack-tool sandbox artifacts from one reviewed source commit.
• Added retrying exact image-tag verification so a brief registry propagation
  delay cannot strand a release after a successful multi-architecture push.
• Made transactional draft lookup compatible with the GitHub CLI versions used
  by hosted release runners.
• Added NIRO_CHANNEL=stable, NIRO_CHANNEL=dev, and NIRO_CHANNEL=rc to the
  macOS, Linux, and Windows installers.
• Kept NIRO_VERSION as an exact stable, dev, or RC pin and made conflicting
  or malformed selectors fail before download.
• Hardened stable CLI and image publication, including guarded recovery of the
  image latest tag.

Security

Stable workflows now reject prerelease tags before testing or publication, pin
the triggering stable tag during builds, and verify the executable version
before upload. Manual image recovery cannot move latest without validating
current public release state. Prerelease publication rejects reused versions
and verifies staged release-asset digests before making a release public. No
developer agent, attacker agent, attack-tool sandbox, CLI permission, or
target-access behavior changed.

Compatibility and upgrade

v0.1.54 was removed from the stable channel because its binaries incorrectly
reported version 0.1.54-dev.3. Anyone who installed v0.1.54 should upgrade to
v0.1.55. There are no CLI, MCP, configuration, or runtime compatibility
changes. The default installer still selects the latest stable release.
NIRO_VERSION=latest is no longer a valid exact pin; omit selectors or use
NIRO_CHANNEL=stable instead. Existing exact vX.Y.Z pins continue to work.

Known issues

• checksums.txt covers the platform archives but does not yet include
  niro.mcpb.
• Release artifacts do not yet include detached signatures, a public binary
  provenance attestation, or an SBOM.
• niro upgrade follows stable rather than dev or RC, and Windows users must
  rerun the installer to change versions.