release: prepare Sandwich Hime v1 beta

Publish the sanitized Beta 1 source candidate with version-stable generated provenance, classroom/evaluation support boundaries, provisional macOS support, signed-source release policy, and an exact candidate preflight.

Material implementation, drafting, and review were assisted by OpenAI Codex. Cole Speelman reviewed the public snapshot and accepts human responsibility for the contribution.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

scripts/verify-public-install.sh

@@ -33,10 +33,24 @@ while (( $# > 0 )); do
 	esac
 done
 
-if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?(\+[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
-	printf 'error: --version must be a semantic version beginning with v\n' >&2
+if [[ ! "$version" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$ ]]; then
+	printf 'error: --version must be a canonical semantic version beginning with v (build metadata is not allowed)\n' >&2
 	exit 2
 fi
+prerelease=${BASH_REMATCH[5]:-}
+if [[ "$prerelease" =~ (^|[.-])(0\.)?[0-9]{14}-[0-9a-f]{12,}$ ]]; then
+	printf 'error: --version must identify a signed release tag, not a Go pseudo-version\n' >&2
+	exit 2
+fi
+if [[ -n "$prerelease" ]]; then
+	IFS=. read -r -a prerelease_identifiers <<<"$prerelease"
+	for identifier in "${prerelease_identifiers[@]}"; do
+		if [[ "$identifier" =~ ^0[0-9]+$ ]]; then
+			printf 'error: numeric prerelease identifiers must not contain leading zeroes: %s\n' "$identifier" >&2
+			exit 2
+		fi
+	done
+fi
 
 for command_name in curl go git false; do
 	command -v "$command_name" >/dev/null 2>&1 || {