DEV-6455: publish Creator Kit 0.1.0-rc.3 prerelease snapshot

[immakermatty]

Summary

• Replaces the synthetic Creator Kit candidate with the authorized public 0.1.0-rc.3 snapshot.
• Includes seven selected English Controller Config/Creator Kit documents and the complete FW 0.12.11 contract plus JSON Schema under CC BY 4.0.
• Preserves one copy-ready Event Player example under MIT; Spectoda names, logos and trademarks remain outside both grants.
• Changes public CI to validate the immutable one-way snapshot and package it deterministically without access to private Documentation.
• Changes the protected release workflow to publish a GitHub prerelease only. stable-channel.json remains unpublished and is never promoted by this workflow.

Locked provenance

• Documentation source: Spectoda/documentation@6f6051686fe556a85318c7dd529ac061ab48c38d
• Documentation export digest: d4e2958303e3fd34dcb5e5c50a8a5c6a0266068ec2f15d88406a2a33bcb1f054
• Firmware source: Spectoda/firmware@51a8d6337d968b47f563bf2decb8f7404d93c27a
• Example source: Spectoda/examples@667b238349cc635792f0e42130a08a4bde701fdf
• Combined bundle digest: 3ceecf7ae03023e727b2b499f40898bc46d6bf7db3629cfaa814c7aee8134667
• Deterministic tar digest: 9c55e368909d2dc36f6171082282e73a9504a3e431ff493c2b308ee04e33aa02

Validation

• bun run creator-kit:check — 7/7 tests, bundle validation and Codex/Claude objective checks passed.
• bun run creator-kit:build — deterministic 5,299,712-byte tar created without mutating the snapshot.
• Two independent Documentation imports were byte-identical.
• Validator pins all seven document source/normalized hashes, both config asset hashes, the exact example bytes and every allowed bundle path.
• Rehashed negative tests reject credentials, private/bare URLs, executable HTML/MDX, metadata/index tampering, harmless document rewrites and extra files.
• Final high-reasoning auto-review — clean, no actionable findings.

Publication boundary

The Principal explicitly authorized publication of this prerelease. Merge is followed by the protected Creator Kit release workflow for version 0.1.0-rc.3 at the exact merged main SHA. No stable-channel promotion, partner Organization mutation or Lazurio installation is included.