fix(release): build Linux and Windows binaries, publish release notes

.github/release-notes/v0.2.0.md

@@ -0,0 +1,25 @@
+korg is a tamper-evident, SHA-256-chained ledger for AI agents. This release turns it into something you can hand to someone else: capture a session, mint it into a signed Certificate, and let anyone re-verify it offline with zero trust in you or in korg.
+
+## Highlights
+
+- **Zero-config capture for Claude Code.** `korg-setup` installs a hook that writes one verifiable ledger per session under `~/.korg/sessions/`. `korg-backfill` captures your past transcripts too.
+- **`korgcert@v1` Certificates.** `korg-seal mint session.jsonl --claim "..."` produces a signed certificate whose human-readable summary (files touched, tools used, steps) is re-derived from the events at verify time, so it cannot lie. Three conformant verifiers (Rust, Python, JS) plus a zero-install browser verifier at https://new1direction.github.io/korg/.
+- **Trusted time.** `korg-seal anchor` binds a public git commit as a witness; `korg-seal resolve` proves the chain existed no later than that commit.
+- **Verify in CI.** The `verify-korgcert` GitHub Action fails a job on a tampered or unpinned artifact and posts the attestation as a sticky PR comment.
+- **An honest swarm.** Workers apply real patches in git worktrees and the ledger attests the real diff, never synthetic numbers. `korg run-once --provider ollama` runs the pipeline on a real local model.
+- **Cross-vendor capture (N=3).** Adapters for Claude Code, OpenAI Codex CLI and Grok Heavy, plus `recall-mcp` for cross-session memory and `introspect-mcp` to expose any `--introspect` binary as MCP tools.
+- **Hardened.** Three adversarial bug-hunt passes fixed 32 real bugs, including a receipt-signature forge and a JS canonicalization divergence. Verifiers are fuzzed and differentially tested across all three implementations with 0 divergences.
+
+## Breaking change
+
+The certificate format `goldseal@v1` is renamed `korgcert@v1`. Seals minted under the old name must be re-minted.
+
+## Try it in 30 seconds
+
+See the [quickstart](https://github.com/New1Direction/korg#readme): build `korg-verify`, verify a real session ledger, edit one event, and watch the verifier name it.
+
+## Downloads
+
+Prebuilt `korg` binaries for Linux x86_64 (glibc), macOS x86_64 and arm64, and Windows x86_64 are attached below.
+
+Full details: [CHANGELOG.md](https://github.com/New1Direction/korg/blob/main/CHANGELOG.md#020--2026-10-05) · Compare: [v0.1.0...v0.2.0](https://github.com/New1Direction/korg/compare/v0.1.0...v0.2.0)

.github/workflows/release.yml

@@ -4,6 +4,12 @@ on:
   push:
     tags:
       - 'v*'
+  # Re-run packaging for an existing release tag (e.g. after a build fix lands on main).
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing release tag to build and attach binaries to (e.g. v0.2.0)'
+        required: true
 
 permissions:
   contents: write
@@ -17,8 +23,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # glibc, not musl: reqwest's default TLS pulls in openssl-sys, which
+          # has no musl OpenSSL to link against on the runner.
           - os: ubuntu-latest
-            target: x86_64-unknown-linux-musl
+            target: x86_64-unknown-linux-gnu
             suffix: ""
             bin_name: korg-linux-x86_64
           - os: macos-latest
@@ -37,19 +45,19 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Install Rust Toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
 
-      - name: Install musl-tools (Linux Only)
-        if: matrix.os == 'ubuntu-latest'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y musl-tools
-
       - name: Build Binary (Release Mode)
+        env:
+          # esaxx-rs (via tokenizers) always builds with the static CRT (/MT);
+          # link everything statically so mimalloc's /MD objects don't clash (LNK2038).
+          RUSTFLAGS: ${{ matrix.os == 'windows-latest' && '-C target-feature=+crt-static' || '' }}
         run: |
           cargo build --release --target ${{ matrix.target }}
 
@@ -68,5 +76,34 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           files: ${{ matrix.bin_name }}
+          tag_name: ${{ inputs.tag || github.ref_name }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  release-notes:
+    name: Publish Release Notes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # Notes come from the triggering ref (main on a manual run), so they can be
+      # added or fixed after the tag was cut.
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Set release body from .github/release-notes/<tag>.md
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          notes=".github/release-notes/${TAG}.md"
+          if [ ! -f "$notes" ]; then
+            echo "No $notes; leaving the release body unchanged."
+            exit 0
+          fi
+          # A tag push can get here before the build jobs create the release.
+          for i in 1 2 3 4 5 6 7 8 9 10; do
+            gh release view "$TAG" >/dev/null 2>&1 && break
+            sleep 30
+          done
+          gh release edit "$TAG" --notes-file "$notes"