ci, docs: harden CI/release, fold WASM workflow, restructure docs - #1

New wasm/ directory with manifest.json (id filerelay-wasm, message capability, no permissions), build.mjs and verify.json. build.mjs assembles an in-tab FIFO loopback queue; WASM transport ABI v1 has no sockets or fetch, so it never contacts a router or shard. The id differs from the native filerelay package so both can be installed side by side.

Discovers every extension directory that has wasm/manifest.json, validates the manifest, runs wasm/build.mjs, ABI-v1-verifies the module and writes a reproducible dist/<id>.ntx plus dist/SHA256SUMS. Supports --version (stamp manifest.version for releases), --out and filtering by extension name. Fails instead of silently building nothing.

Node test runner, no Go or network: package layout is exactly manifest.json plus the .wasm entry; policy checks (no permissions, message capability only, id ends in -wasm and differs from the native id); sandbox and loopback queue behaviour; reproducible builds; --version stamping and rejection of bad versions; unknown extension name fails.

On changes under transports/ (push to main, pull requests, manual): syntax-check the scripts, run the package tests, build, require a second build to be byte-identical, check each package contains exactly manifest.json and the .wasm entry, and upload the packages and SHA256SUMS as an artifact. Release assets are still attached only by release.yml.

Set up Node, run the package tests, build with the release version and copy the result to filerelay-wasm_<version>_browser.ntx. Verify the package (valid zip, exactly two members, manifest id, version, api_version, entry and empty permissions). Include it in the checksum file and raise the expected bridge asset count from 7 to 8 (6 native, 1 browser, 1 checksum). Add it to the expected asset patterns.

README and the filerelay README describe filerelay-wasm.ntx, how to build and test it, and its limits (in-tab loopback, messages only, never contacts a router or shard; use the native package for a real relay). RELEASING.md lists the new release asset, updates the checksum description to seven bundles, and describes where the bundles are built.

Merge the standalone wasm-extension.yml into ci.yml as a wasm job, so one workflow mirrors what release.yml validates (Go build, vet, test, race, vuln scan, and the browser extension). The job keeps every old check: syntax, ABI v1 conformance tests, build, byte-identical rebuild, package contents, artifact upload. wasm-extension.yml is deleted.

Also add vet and test of the transports/filerelay courier bridge to the build job, go mod verify after download, a workflow_dispatch trigger, per-job timeouts, and a concurrency group that cancels superseded runs.

…able release

Split the single job into validate and release. The workflow now defaults to contents: read, and only the release job gets write, id-token, attestations and artifact-metadata permissions. Releases must come from main and from a GitHub-verified (signed) commit, checked in both jobs.

The validate job checks go.mod/go.sum tidiness, gofmt, vet, build, tests with the race detector, govulncheck (pinned v1.7.0), the bridge tests, the WASM checks including a byte-identical double build, and that no worktree changes remain.

The release job no longer pushes the tag manually. It creates a draft release targeting the validated SHA, so GitHub creates the tag on publish and a failed run leaves no stray tag. It refuses to touch a published or immutable release or a tag at a different commit. GoReleaser runs with GORELEASER_CURRENT_TAG and --skip=publish,validate, pinned to ~> v2 instead of latest.

Bundles: build the six native .ntx packages with -trimpath and check manifest and package contents, verify WASM reproducibility, verify checksums (7 entries) with sha256sum -c, attest the checksums, upload a workflow artifact, upload an explicit asset list, publish, then verify the immutable release (target commit, prerelease flag) and its release attestation. Failed runs clean up only a draft release that this run created.

…ooting

Add a table of contents and a prebuilt packages section with the install command. Split the quick start into running the server and using it from NexTalk, covering both file transfer (transport register, xfer-send, xfer-recv) and chat by peer ID (register-identity, resolve, peer connect), with the PowerShell JSON quoting form.

Add a Which command do I need table and a troubleshooting table (unregistered recipient, stale replay attach, lost --server-secret, old bridge, per-server registrations, clock skew, HTTP 429). Document the filerelayd flags in a table. Add a reminder to reinstall the bridge after rebuilding. Remove em dashes and unwrap long paragraphs.

…s and quick starts

Reorganize around prebuilt .ntx installation with checksum verification, install and configure (bash and PowerShell), a send-a-file quick start, and a chat-by-peer-ID quick start using register-identity. Add a Which command do I need table, a troubleshooting table with the state.json location, and a Build and package section.

Expand the trust model (identity registration is signed by NexTalk core, FileRelay mailbox IDs are 16 bytes so there is no alias map), fix the old --user flag to --id in the two-user scenario, note that register already attaches its mailbox, and point the CI note at ci.yml now that wasm-extension.yml is gone.