[Phase 3] Prepare pre-alpha release packaging

[Saber5656]

Background

A public repository is not the same as a release. Even while Cage remains pre-alpha, the project should document how future releases, artifacts, checksums, and installation paths will work.

Scope

• Decide the priority order for cargo install, GitHub Releases, and Homebrew.
• Restrict release publication to v* tags or manual workflows.
• Do not publish packages from a main merge alone.
• Decide whether binary checksums, SBOMs, and artifact attestations are required for the first release.
• Avoid curl | bash, or require checksum verification if an install script is introduced.

Acceptance Criteria

• README states that there is no release yet and documents the release policy.
• Any release workflow uses only manual or tag-based gates.
• Any install script includes SHA256 verification.
• The project records that publish tokens should not be stored as repository secrets.

References

• cage-demo/docs/architecture/tech-selection.md section 4
• cage-demo/docs/PRD.md SEC-ISSUE-002 and SEC-ISSUE-003
• github-oss-repo-hardening Release / Package Safety