[zeth]

Linux signing is still a separate dispatch whose staging input is selected by artifact name/run. Add release.py sign-linux --record ... --wait to request the existing signing workflow with the exact accepted staging artifact ID and ZIP checksum, report its reviewer wait, and retain the signed output in the candidate record.

Before dispatch, verify staging run/attempt identity, workflow source, artifact ownership/expiry, ZIP and payload checksums, and component/SDK provenance against the framework candidate. Persist those input facts before the request. Both signing-workflow jobs download and check that immutable artifact ID/checksum; the verification summary shows the pins before approval, and signing metadata retains them. Existing manual inputs remain supported when both new pin inputs are blank.

The linux-release-signing gate and existing signing, signature verification, signed-image smoke test and attestation stay in the workflow. The coordinator only reads pending deployment state; it never approves the gate. Successful output is checked against the retained staging provenance and signing handoff, then saved with artifact/archive identity, seven file hashes, metadata and expiry. Signed bytes may differ from staged bytes; both identities are retained.

Interrupted dispatches reconcile without a second run. Targeted failed-job retries reuse builds/staging; pending approval is not treated as a failed run. Pinned staging and accepted signed output cannot be replaced in the same record. Expired inputs stop pending/retried signing, while a finished successful signed bundle can still be captured after staging expiry. Update the runbook and add the Linux signing/recovery guide. Correct the stale manual-runbook claim that manifest generation is not automated.

Validation: 105 release tests and 41 staging tests pass. New coverage includes complete signing/resume, approval waiting without approval writes, uncertain dispatches, failed-job retry, immutable accepted inputs/outputs, expiry, wrong component/SDK provenance, wrong handoff metadata, exact worker downloads, and ID/hash/ownership/payload rejection. Shell syntax, workflow YAML, boundary, version and diff checks pass. A read-only live check confirms the Linux environment still has required-reviewer and branch policies; no environment settings were changed. No actual build, signing, promotion or publishing dispatches, tags or uploads were performed. Validate the full remote signing path through the next actual release.

Continues #120 and #122. Linux/core promotion and final destination reporting remain subsequent slices.