Repair release archives and document current Sized distribution

TODO.md

@@ -23,23 +23,41 @@ Keep the existing CLI useful and preserve the GPL-3.0-only license.
   cliff-mads runner. Keep its container isolation and other jobs unchanged;
   verify a real workflow result before treating CI as proven.
 
-## Proposed next work
+## Approved project page and release cleanup
 
-SizeQueen now includes a byte-identical scanner snapshot in a small core crate,
-removing terminal dependencies and allowing independent builds. Extract that
-shared core upstream in a separate PR after the behaviour changes are reviewed;
-terminal formatting is already separate from scan logic.
-Windows allocation support and very-large/deep-tree tuning need separate evidence.
-README/MANUAL/Cargo metadata still contain legacy GitLab addresses; reconcile
-them against available Gitea releases before changing distribution instructions.
-Before producing release assets, fix and verify `scripts/release.sh`: it currently
-creates the tarball before copying the executable into its input directory.
-Do not release/tag/publish automatically. The requested review-branch push is
-authorized; see `SHIPMENT.md` for source review and the separate release process.
+The owner approved a Sized project page in the shared Gamertan CMS, truthful
+installation/release guidance, packaging repairs, and a Built on Sized section
+on SizeQueen. Website delivery is tracked in that repository's existing queue.
+
+- [x] Inspect the public v1.0.0 assets; the unlabelled executable is macOS arm64,
+  ad hoc signed, SHA-256 `50fde4d8215babbb64f4a4f55e030dd5c941a97ed1bedfa80392e4301c52d2bf`.
+  There are no attached Linux binaries, labelled archives or Debian packages.
+- [x] Replace stale GitLab/unsupported package-manager installation claims with
+  explicit review-branch source builds; explain the published release boundary.
+- [x] Package the executable before the archive; include licence/docs/build
+  provenance, target-labelled names and checksums. Reject output replacement.
+  Remove incidental installer generation; host binaries must not become `.deb`s.
+- [x] Verify archive contents/checksum, run the extracted CLI and test overwrite
+  refusal on macOS arm64. Add the same verification to Linux CI.
+- [ ] Verify the updated cliff-mads workflow, push the review checkpoint and
+  record the public CMS delivery. No new version, release assets or merge yet.
+
+## Deferred / next release
+
+SizeQueen now pins the extracted private `sized-core`; Sized retains its own
+scanner copy. Adoption must keep public builds independently fetchable.
+Review scanner/API/status changes before merging the existing branch. Select a
+new release version, verify target-specific installation and package complete
+corresponding source/dependency notices before publishing fresh binary assets.
+Do not replace historical v1.0.0 files. Windows allocation and very-large/deep
+scan tuning remain separate work. See `SHIPMENT.md` for the release process.
 
 ## Resume note
 
-Current CI checkpoint: repository Actions is enabled and a real native AMD64
+Current work: the approved project page and packaging cleanup above. Local Mac
+archive verification passes; updated Linux CI and CMS publication are pending.
+
+Previous CI checkpoint: repository Actions is enabled and a real native AMD64
 push run passed on cliff-mads. [Gitea run 1048 (number 2)](https://gitea.speelman.ca/gamertan/sized/actions/runs/1048)
 tested `74b30bbf750417121f3b0c26017d2f011a2a8286` on
 `cliff-himesan-linux-amd64` (`gitea-runner v3.1.0`): all 23 tests, formatting,