docs: record git-cas v6.5.3 publication

[flyingrobots]

Linked Issue

• Refs perf: preserve Git object sessions across coherent writes #94.
• The implementation issue is already closed by Preserve coherent Git object sessions #95; this PR records immutable publication evidence and does not introduce another runtime change.

Summary

• record the signed v6.5.3 tag, reviewed merge, and successful release workflow
• record npm integrity, shasum, package size, dist-tag, and SLSA provenance evidence
• advance STATUS.md from release candidate to published artifact posture
• make the release-state contract require the immutable publication witness
• correct stale historical latest wording now that v6.5.3 owns that dist-tag

Design / Proof

• Design doc: docs/design/0053-git-object-session-coherence/git-object-session-coherence.md
• Release candidate: docs/design/0053-git-object-session-coherence/witness/release-candidate.md
• Publication witness: docs/design/0053-git-object-session-coherence/witness/release-publication.md
• External proof: signed tag v6.5.3, release workflow 29696131557, npm attestations, and final GitHub Release

Validation

pnpm exec prettier --check STATUS.md docs/design/0053-git-object-session-coherence/witness/release-publication.md test/unit/docs/release-state.test.js
pnpm exec vitest run test/unit/docs/release-state.test.js test/unit/docs/release-truth.test.js test/unit/docs/package-docs.test.js
pnpm run lint
pnpm test

• Focused release contracts: 31 passed.
• Node unit gate: 224 files, 2,082 passed, 2 skipped.
• Exact release merge verification: 14/14 steps, 6,829 observed tests.
• Release workflow 29696131557: successful validation, Node/Bun/Deno tests, trusted npm publication, and GitHub Release.
• npm and GitHub Release were queried independently after publication.

Release Impact

• No runtime behavior or public API changes in this PR.
• Current status and immutable publication evidence now report shipped reality.
• Executable documentation tests reject regression to candidate posture.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 16 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 16cb6060-b163-4053-8d5e-c996ec617a60

📥 Commits

Reviewing files that changed from the base of the PR and between 00df607 and eff8d84.

📒 Files selected for processing (3)

• STATUS.md
• docs/design/0053-git-object-session-coherence/witness/release-publication.md
• test/unit/docs/release-state.test.js

---

_{Comment @coderabbitai help to get the list of available commands.}

[flyingrobots]

@codex self-code review: clean.

Severity	Count
Critical	0
High	0
Medium	0
Low	0
Markdown/style	0

Reviewed the complete diff against origin/main for factual accuracy, release identity, stale-state contradictions, test intent, Markdown formatting, and scope discipline.

Evidence rechecked independently:

• signed tag object efd1a1e0f9d71cf971a74d254d2661a52b366a81 peels to reviewed merge 00df6077f1f9c111b9d0d9b636b7d746df0d2aad;
• git tag -v v6.5.3 reports a good signature from key 01A63D8E9DBEEDE32918AF9C39560E0406CA9135;
• release workflow 29696131557 succeeded on that SHA;
• npm independently reports version, latest, integrity, shasum, file count, unpacked size, and SLSA provenance matching the witness;
• GitHub independently reports a final, non-draft, non-prerelease v6.5.3 release;
• formatting and diff checks pass;
• focused release contracts: 31/31;
• full Node unit gate: 2,082 passed, 2 skipped;
• exact release merge verifier: 14/14, 6,829 observed tests.

The first focused run correctly exposed a stale historical v6.5.2 “latest tag” assertion. It was repaired before commit, along with stale v6.5.0 dist-tag wording, and the complete suite was rerun green.

Please confirm there are no findings requiring another commit.