feat: harden reviewed registry releases

docs/RELEASING.md

@@ -14,7 +14,8 @@ define the build behavior. A lockfile pins dependencies, not the host compiler.
 The Forgejo workflow uses the documented [workflow and context syntax](https://forgejo.org/docs/latest/user/actions/reference/).
 Register `site-registry-isolated` only on a disposable, repository-scoped runner
 with the above tools, two build jobs and at least 4 GiB memory. Use a pinned,
-reviewed runner image. Do not mount production directories, share signing keys,
+reviewed runner image; the exact local build is in [ci/Dockerfile](../ci/Dockerfile).
+Do not mount production directories, share signing keys,
 or use Argand's host runners. Follow Forgejo's [runner security guidance](https://forgejo.org/docs/latest/user/actions/security/).
 The label is a deployment requirement, not a provisioned runner supplied by this
 repository. The workflow runs on trusted main pushes or manual dispatch, fetches
@@ -85,6 +86,8 @@ receipt; the initial release tool packages source only.
 
 Source releases contain no provider datasets or real approvals. Dataset publishers
 follow the operator guide: import, inspect, review, build, diff, sign and activate.
+Follow the [publisher runbook](PUBLISHING.md); release signing requires the external
+reviewer trust file and re-verifies every stored decision signature.
 The dataset namespace `argand-site-registry` is distinct from the source namespace
 above. Keep `LICENSE_SOURCES.md` and `ATTRIBUTION.json` with the database and receipt.
 The weekly update example creates candidates. It never approves, renews, signs or