[zeth]

Candidate preparation currently needs separate Release build dispatches, manual run-ID tracking, manifest generation/commit and three staging dispatches. An interruption makes it difficult to tell what can safely be reused.

Add release/scripts/release.py prepare and status, with an atomic local release record, readable summary and optional waiting. Preparation freezes the selected source on an RC branch, coordinates the existing Daemon/Desktop Release workflows, verifies their component/SDK artifacts, invokes the shared manifest generator and records manifest/evidence in a candidate metadata commit. All three staging workflows run on main, reading that immutable manifest commit and its pinned artifact IDs; this preserves the Windows environment’s existing main-only rule and tester-signing default.

Dispatch intents are persisted before API writes. Returned run IDs and unique request identifiers support recovery after uncertain responses without duplicate dispatches. Track workflow revisions, attempts, failed history, artifact IDs/digests/expiry and accepted pins. Targeted retries use failed-job reruns; successful siblings remain in place. Moved branches, changed/expired accepted inputs, altered manifests and unexpected run identities stop preparation. Builds already captured in a verified manifest require a new candidate rather than replacing its inputs. Existing manual workflows remain available.

This is the first #120 slice: preparation through staged artifacts. The summary retains signing/platform/package validation and the maintainer publication decision as remaining work. Promotion, verified Python-distribution reuse/publication, PPA completion and final destination reporting remain subsequent slices; this command creates no production tags and calls no publishing workflows.

Validation: all 60 release tests and 41 staging tests pass, including a complete simulated preparation, restart/polling, lost responses, pagination, targeted retries, interrupted retry recovery, source/input drift, expiry, record locks, read-only status, manifest fetch/path validation and publication-workflow rejection. Read-only GitHub checks validated the selected source version, API version and missing-ref handling. Boundary, YAML, version and diff checks pass. No actual Release builds, staging runs or publication were started as a rehearsal; the next actual release will exercise the complete flow.

Continues #120 and #122. The runbook and release/docs/candidate-preparation.md document inputs, remote operations, outputs and recovery.