feat(ci): emit release-manifest fragment artifact (H3)

scripts/emit-release-fragment.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Emit a release-manifest fragment describing the artifact this CI run produced.
+# Provenance only - it never blocks. sow-platform's promotion (D24) consumes it.
+#
+# Env (all optional except REPO + SHA):
+#   FRAG_REPO     repo name (e.g. sow-codebase)         [required]
+#   FRAG_SHA      git sha of the build                  [required]
+#   FRAG_ARTIFACT artifact name (image ref or filename) [required]
+#   FRAG_FILE     path to a built file to checksum       (optional)
+#   FRAG_DIGEST   image digest if known                  (optional)
+#   FRAG_URL      publish URL                            (optional)
+#   FRAG_RUN_ID   CI run id                              (optional)
+#   FRAG_OUT      output path (default release-fragment.json)
+set -euo pipefail
+: "${FRAG_REPO:?set FRAG_REPO}"; : "${FRAG_SHA:?set FRAG_SHA}"; : "${FRAG_ARTIFACT:?set FRAG_ARTIFACT}"
+out="${FRAG_OUT:-release-fragment.json}"
+
+checksum=""
+if [[ -n "${FRAG_FILE:-}" && -f "${FRAG_FILE}" ]]; then
+  checksum="$(sha256sum "$FRAG_FILE" | cut -d' ' -f1)"
+fi
+
+cat > "$out" <<JSON
+{
+  "repo": "$FRAG_REPO",
+  "sha": "$FRAG_SHA",
+  "artifact": "$FRAG_ARTIFACT",
+  "digest": "${FRAG_DIGEST:-}",
+  "sha256": "$checksum",
+  "publish_url": "${FRAG_URL:-}",
+  "run_id": "${FRAG_RUN_ID:-}"
+}
+JSON
+echo "emit-release-fragment: wrote $out"