release: WRNexusJS 0.7.0

PUBLISHING-0.7.0.md

@@ -0,0 +1,27 @@
+# Publishing WRNexusJS 0.7.0 privately
+
+Run the production gates before staging packages:
+
+```sh
+bun install
+bun run validate:0.7
+bun run security:framework
+bun run sbom
+bun run benchmark:framework
+bun run validate:staging
+bun run check
+```
+
+Prepare, commit, and publish only from a clean branch:
+
+```sh
+bun run release:prepare
+git add --all
+git commit -m "release: WRNexusJS 0.7.0 security and performance foundation"
+git push origin main
+bun run release:private
+```
+
+The release workflow validates the 0.7 migration, framework security audit, deterministic CycloneDX SBOM, benchmark budgets, full type/lint/test/format checks, deterministic UI references, restricted package staging, package SHA-256 manifests, clean Git state, and private-registry policy.
+
+The staging verifier rejects secrets, private keys, source maps, TypeScript source files other than declarations, and unexpected environment files before publication.