Record Phase 7 release owner decisions

[bordumb]

What changed

• Records all 11 AP-SPEC-032 Phase 7 owner decisions with their exact scope,
  conditions, and remaining non-authorization boundaries.
• Selects the lean SDK-first public surface: auths-proof and the renamed
  auths-proof-sdk Rust roots, @auths-dev/proof on npm, auths-proof on
  PyPI, the source archive, and the assurance bundle.
• Requires SLSA 1.2 Build Level 3 for every first-RC subject with no Level 2
  fallback.
• Approves keyless GitHub Actions OIDC and public Sigstore attestations for the
  release build while preserving offline verification and keeping Auths
  independent of hosted identity at runtime.
• Separates SLSA/Sigstore build integrity from an optional Auths-native exact
  release-authorization proof and prevents a candidate from being the sole
  verifier of its own authority.
• Adds an owner decision guide and reconciles the readiness audit and
  AP-SPEC-027/AP-SPEC-032 wording with the approved decisions.
• Links the separately gated publication follow-up (Publish verified Auths RC to GitHub, crates.io, npm, and PyPI (post-gate) #50) and deferred SDK
  extension-surface follow-up (Defer profile-kit and proof-exchange from the first SDK release surface #51).

Why

PR #49 merged the governing specifications with the owner decision register
still unresolved. Phase 7 implementation cannot begin until those decisions
are exact and reviewable. The existing local auths-sdk package coordinate
also collides with the superseded project package already present on
crates.io, so the maintained SDK needs the unambiguous public coordinate
auths-proof-sdk before package metadata is frozen.

Developer impact

This is the bounded owner-decision closure unit from AP-SPEC-032. It changes no
runtime, release automation, package metadata, repository setting, artifact,
tag, or public claim. A later semantic-freeze PR must implement the package
rename and machine-enforced catalogue after the full Phase 7 entry gate
passes.

Tests and evidence

• cargo xtask spec-sync
• cargo search auths-sdk --limit 10 confirms the existing crates.io package
• cargo search auths-proof-sdk --limit 10 returns no existing package
• cargo tree --locked --offline --all-features --edges normal -p auths-proof -p auths-sdk
  establishes the current 27-crate normal-dependency closure
• git diff --cached --check
• trailing-whitespace scan for every changed Markdown document
• repository and organization numeric IDs resolved through the authenticated
  GitHub repository record for immutable OIDC subject policy

Affected claims

No shipped capability or public assurance claim changes. Future release
evidence may claim SLSA 1.2 Build Level 3 only after the implemented builder is
assessed against every applicable requirement. Auths-native release
authorization may be described only as authorization evidence, not provenance,
SBOM evidence, reproducibility, or independent review.

Exclusions

• No Cargo package rename or dependency change
• No semantic-freeze or release-manifest implementation
• No workflow, environment, OIDC-setting, or permission change
• No artifact preparation, attestation, publication, or package upload
• No RC tag creation or promotion
• No public assurance-claim publication
• No reviewer or design-partner engagement
• No Phase 8, Phase 9, or Phase 10 implementation

Remaining gate conditions

• This decision record must merge to main.
• The selected entry revision must have real terminal evidence for every other
  AP-SPEC-032 Phase 7 entry condition.
• The semantic-freeze PR must rename the local package to auths-proof-sdk,
  generate the exact release catalogue, and make excluded packages
  non-publishable as required.
• The release-evidence PR must establish a digest-pinned reusable builder,
  SLSA 1.2 Build Level 3 conformance, SPDX 2.3 coverage, Sigstore bundles, and
  offline verification.
• Protected environment and immutable OIDC-subject settings require separate
  repository authorization and real configuration evidence.
• Publication remains separately blocked on Publish verified Auths RC to GitHub, crates.io, npm, and PyPI (post-gate) #50 and an owner authorization for
  the exact release-manifest digest.
• AP-SPEC-033 independent review remains an external Phase 9 gate; later phases
  remain blocked.