docs: record verified development delivery and explicit release gates

Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.

docs/release-process.md

@@ -0,0 +1,72 @@
+# Release process
+
+No release is authorized by the existence of these scripts. No workflow publishes
+to either store. A debug APK or unsigned archive is not a production release.
+
+1. Complete every outstanding gate in `validation.md` and `security-review.md`.
+   Obtain independent human review of authentication, navigation, file handlers,
+   local erasure and privacy disclosures. Run actual supported device/OS tests.
+2. Resolve bundle/application identifier ownership. `community.yuvomi.mobile` is
+   a provisional community identifier, not proof of registry/store ownership.
+   Confirm use of the Yuvomi name, required attribution and independent status.
+3. Bump version/name/code in Android and the iOS project spec; update CHANGELOG.
+4. Run JVM/emulator/real-upstream HTTPS tests, portable Swift and Xcode simulator
+   tests, static checks, OSV scan, release builds and artifact inspection. Record
+   upstream revision, app SHA, OS/WebView/Xcode versions, results and checksums.
+5. Produce signed artifacts only using an authorized maintainer's credentials.
+6. Review store privacy/Data Safety answers for the app AND selected-server model,
+   permission rationale, encryption/export compliance, screenshots, support URL,
+   vulnerability contact, and device demonstrations. A functional web companion
+   is not guaranteed to pass Apple's minimum-functionality review.
+7. Create a release/tag and publish artifacts/store submissions manually only
+   after explicit maintainer authorization. Never force-push or rewrite history.
+
+## Android
+
+The manual `release.yml` workflow uses a protected GitHub environment named
+`release`. Configure branch restrictions and required reviewers before adding
+secrets. With `sign_android=false` it emits unsigned artifacts. Signing requires:
+
+- `ANDROID_KEYSTORE_BASE64`
+- `ANDROID_STORE_PASSWORD`
+- `ANDROID_KEY_PASSWORD`
+- `ANDROID_KEY_ALIAS`
+
+The workflow uses `zipalign`, `apksigner`, and `jarsigner`; private material exists
+only in a restrictive runner-temporary file removed on exit. Securely back up the
+real upload key and use Play App Signing according to the owner's policy. No
+production key is generated here. Manually verify APK/AAB signatures and inspect
+the final manifest: no debuggable flag, HTTP/test CA or unintended exported component.
+Never distribute an `.integration` package or include its generated test resources.
+Run `python3 scripts/collect-android-artifacts.py` immediately after the clean-source
+build to inspect unsigned outputs and record local hashes/source identity. This
+collector intentionally rejects signed release outputs; collect before signing.
+
+## iOS
+
+The CI archive is unsigned and cannot be uploaded to App Store Connect. An owner
+needs Apple Developer Program membership, a registered app ID, distribution
+certificate/private key, provisioning profile and App Store Connect permissions.
+
+Generate/open the project, choose the authorized team, set the owned bundle ID,
+select a physical/generic iOS destination, and use Product -> Archive. Validate
+the archive in Organizer and export using the owner's distribution method. For
+CLI export use a **locally supplied** ExportOptions.plist with the correct team,
+method and provisioning mappings:
+
+```sh
+xcodebuild -exportArchive -archivePath artifacts/Yuvomi.xcarchive \
+  -exportPath artifacts/ios -exportOptionsPlist /secure/path/ExportOptions.plist
+```
+
+Do not add distribution certificates, profiles, App Store keys or passwords to the
+repository. Device camera, Files, VoiceOver, memory pressure and app-switcher
+privacy need physical-device validation beyond simulator tests.
+
+## CI hosting
+
+GitHub Actions files are provided, but the configured community remote is hosted
+on a different forge. GitHub workflows will not automatically run there. Enable
+an authorized GitHub mirror/repository (or port the jobs to the forge's runner)
+and inspect real runs before claiming CI is operational. No destination is
+created automatically. CI service availability is not an application dependency.