Point new machines at the attested release v2026.09.25.1 - #259

Scope

• What this PR changes: points new machines at the attested release v2026.09.25.1. It sets adoption/manifest.json source.release_tag to v2026.09.25.1, release_commit to ae3d3d37377022fe63112dcb10c93c765d6d2601 and updated_at to 2026-09-25, and re-registers the file's hash in manifests/evidence.json.
• Why .1: the earlier re-pin to v2026.09.25 went stale when Workstation lane wave A: systemd re-record, SPY/LEAN parity host replay, Nemotron qualification on the RTX 4090, ai-memory 2.4.0 review #256 changed new-machine files after that tag. v2026.09.25.1 is cut on main after Workstation lane wave A: systemd re-record, SPY/LEAN parity host replay, Nemotron qualification on the RTX 4090, ai-memory 2.4.0 review #256 to Record token-stack host receipts on the workstation: RTK hook path, repomix, toon, Context Mode, jCodeMunch, Serena, ccusage #263, Record scheduled memory learning and daily native lifecycle evidence #116 and Record NativeStack workstation acceptance and retained failures #160, so it contains every new-machine file now on main. Merges that touch new-machine files were held during the release window (native-agent-stack-8c, native-agent-stack-e7, cleanup-wsl-audit-nativestack).

Release evidence (verified 2026-09-25)

• Tag v2026.09.25.1 (annotated object 0a72dac8) points at ae3d3d37, whose main CI passed: validate, token report, adoption bootstrap smoke, published evidence, security scan and Scorecard.
• publish-catalog run 36171819457 succeeded (publish and release jobs). The release is immutable, not a draft and not a prerelease.
• gh attestation verify, with --signer-workflow .../publish-catalog.yml --source-ref refs/tags/v2026.09.25.1 --source-digest ae3d3d37... --deny-self-hosted-runners, succeeded for:
  • native-agent-stack-ae3d3d37....tar.gz, SLSA provenance v1, sha256 b90f26a5b7dfe6cec24f1200f795f001ca0da3fadc58ce97ac684bd16ccfbbbf;
  • native-agent-stack-ae3d3d37....spdx.json, predicate https://spdx.dev/Document, sha256 dcd2868d6117029da59a73c5d997ad62bf0c406d30bc15cfed2fcdd9f81064ed.
• gh release verify-asset succeeded for both assets, and gh release verify v2026.09.25.1 succeeded.

Checks run on this branch

• scripts/release_due.py --strict-if-repinned origin/main: status current, no changed files.
• tests/test_adoption_docs_consistency.py, tests/test_adoption_contract.py and tests/test_release_pin_contents.py: 63 passed, 1 skipped. The skip is expected: no profile's coverage differs between the pinned release and HEAD.
• scripts/validate.py: passed (69 components, 147 receipts). This covers integrity and scope only, with no live provider or GPU execution.

🤖 Generated with Claude Code