Ship a protected, reproducible v0.1.0 Small-Team Beta release

[tiammomo]

Summary

ModelPort already contains a signed and attested release workflow, but the public repository has no protected main branch, no tag, no GitHub Release, and no immutable install artifact. Deliver the first externally installable Small-Team Beta as one release capability.

Actual behavior

The documented normal-user quick start references v0.1.0 and GHCR images that do not exist. The main branch is unprotected, all current checks are non-required, Dependabot security updates are disabled, and the repository has no tags or releases, so the repository does not satisfy its own release preconditions.

Expected behavior

A reviewed release-preparation change and repository settings establish protected-main governance, align every v0.1.0 version and deployment reference, pass the complete release acceptance matrix, and publish verifiable immutable Linux amd64 artifacts through the existing tag-triggered workflow.

Steps to reproduce

Open the repository Releases and Tags pages, query main branch protection, and compare the results with docs/RELEASING.md and the README normal-user quick start.

Environment

Public tiammomo/ModelPort repository at main 14ea1f5 on 2026-08-24.

Acceptance criteria

• Protect main with required repository checks, CodeQL, dependency review, PostgreSQL dashboard E2E, pull-request review, and admin enforcement; protect release tags and enable required security settings.
• Land one focused release-preparation PR that aligns Cargo, Dashboard, lockfile, Compose image references, changelog, compatibility, and installation documentation at v0.1.0 without adding unrelated protocol, Provider, GPU, or Dashboard breadth.
• Pass scripts/check-all.sh plus clean-install, migration, safe-stop, backup/restore, upgrade, rollback, and source-to-release acceptance on Linux amd64 with PostgreSQL 18.4.
• Create a reviewed signed v0.1.0 tag only after the protected main commit and evidence digest are fixed; the existing release workflow must publish the backend archive and all three versioned GHCR images with checksums, SPDX SBOMs, provenance attestations, immutable digests, and signatures.
• Publish a prerelease GitHub Release whose assets and image digests can be independently verified, then run the documented normal-user quick start from immutable release artifacts rather than a source build.
• Record rollback, known limitations, and exact support tier honestly; no hosted-service, HA, broad protocol, full Provider-compatibility, or general GPU-management claim is introduced.