milestone 14: verify-a-release walkthrough run against v0.0.1, acceptance closed

specs/milestone-14.md

@@ -695,13 +695,16 @@ was reproduced before it was fixed.
 - [x] Two runs of `zig build dist` on the same commit produce byte-identical
       tarballs **in the same directory**. (Cross-directory reproducibility is
       ruling 12 and is not claimed here.)
-- [ ] The image builds for both platforms with no qemu, carries `/LICENSE` and
+- [x] The image builds for both platforms with no qemu, carries `/LICENSE` and
       `/THIRD-PARTY-NOTICES` and the OCI labels, and its binaries are
-      byte-identical to the tarball binaries. Verified for the native amd64
-      image only; the arm64 half needs a runner with buildx.
-- [ ] `gates.yml` runs from both `ci.yml` and `release.yml`; `ci.yml` triggers
-      on `master`; `origin/main` is gone. The first two are in the files; no
-      workflow has run and `origin/main` still exists (manual prerequisite).
+      byte-identical to the tarball binaries. The v0.0.1 run built and pushed
+      both platforms on the runner; the published index lists exactly
+      `linux/amd64 linux/arm64`, and `release verify-image-binaries` compared
+      both binaries against the tarballs before publication.
+- [x] `gates.yml` runs from both `ci.yml` and `release.yml`; `ci.yml` triggers
+      on `master`; `origin/main` is gone. Proven live: pushes to `master` run
+      the gates through `ci.yml`, and release runs 484-493 ran them through
+      `release.yml`.
 - [x] `THIRD-PARTY-NOTICES` covers musl, the Zig runtime, SQLite, Mbed TLS with
       its Apache-2.0 selection line and full text, Everest, p256-m and the web
       runtime closure. The dependency drift guard was proven able to fail:
@@ -715,10 +718,21 @@ was reproduced before it was fixed.
       multi-architecture image — and was then deleted (release, git tag, both
       registry versions). Five attempts; the failures and their fixes are
       deviations 23-26.
-- [ ] `v0.0.1` is published: five assets, a verifying signature, and an image at
-      `git.mial.net/mokhtar/nxdns:0.0.1` and `:latest`.
-- [ ] `docs/how-to/verify-a-release.md` was followed end to end against the
-      published release, from a clean directory, on this host.
+- [x] `v0.0.1` is published: five assets, a verifying signature, and an image at
+      `git.mial.net/mokhtar/nxdns:0.0.1` and `:latest`. Run 493, all jobs green
+      on the first attempt after the dry-run fixes.
+- [x] `docs/how-to/verify-a-release.md` was followed end to end against the
+      published release, from a clean directory, on this host, with a clean
+      `GNUPGHOME` holding only the key fetched from keys.openpgp.org. Every
+      command on the page passed: the `releases/latest` redirect printed
+      `0.0.1`, both tarball downloads and the `latest` alias worked (and
+      GitHub's spelling answered 404 as documented), the signature verified
+      with matching primary and subkey fingerprints, `sha256sum -c` said OK for
+      all three files, the tarball layout and modes matched, `nxdns version`
+      printed the tag's commit, the tag digest equalled `IMAGE-DIGEST.txt`, the
+      platform list was exactly `linux/amd64 linux/arm64`, and the binary
+      copied out of the pulled-by-digest image hashed identical to the tarball
+      binary.
 - [x] No `zig build cross` or source-only-distribution text remains on any
       **active** surface: `build.zig`, the workflows, `deploy/`, `README.md` and
       `docs/`. Historical milestone specs and `TECH_DEBT.md` keep their text —