### The release carries libwai for C, the Swift and Android packages, and the relay's and room service's images

- **C** (`quickstart/build-libwai.sh`): each Linux job of the release attaches
  `libwai-<version>-<triple>.tar.gz`, for `x86_64-` and `aarch64-unknown-linux-gnu`. It holds
  `lib/libwai.a`, built from wai-rs with the feature `native_sink` (the envelope and the native
  sink, the C interface the Swift and Android packages carry; no codec library), for the glibc
  target and without crt-static; the committed `include/wai.h`; and `lib/pkgconfig/wai.pc`, whose
  prefix is its own directory and whose `Libs` name the system libraries the static library needs.
  The library is static so that a program carries it: nothing of libwai is looked for when the
  program runs, and its C runtime is the one it is linked against. Before it is attached, the header
  the build regenerated must be the committed one, the library must define exactly the envelope's
  and the native sink's functions (`quickstart/libwai_interface.py`), and
  `quickstart/test/c-library.sh` compiles `quickstart/test/c/hello.c` against the archive with the
  flags `pkg-config --cflags --libs wai` gives, links it and runs it.
- **Swift** (`wai-sink-swift`): `Package.swift` names the binary target `WaiFFI` by URL and checksum
  where a release has written them, and `build/WaiFFI.xcframework` while it is built there. The
  release's `swift` job builds every slice and attaches `WaiFFI-<version>.xcframework.zip` and
  `wai-sink-swift-<version>.zip`, the package whose `Package.swift` names the zip by its download
  URL and SwiftPM checksum (`scripts/package-release.sh`). `scripts/check-release-package.sh`
  resolves, builds and runs an application that depends on the package, before the attach with the
  framework served through a mirror of the URL and after from the URL itself, and requires the
  package with a wrong checksum to be refused; `wai-sink-swift.yml` runs the first on every change.
- **Kotlin** (`wai-sink-android`): the library is published with maven-publish as
  `science.transaction.wai:wai-sink:<version>`, the version of wai-rs, and its manifest is of the
  package `science.transaction.wai.sink` (it was `wai.sink`; the Kotlin classes keep the package
  `wai.sink`, which the JNI layer's symbols name). The release's `android` job holds the publication
  to `scripts/check-publication.sh` (its coordinates, its manifest's package, both libraries of each
  ABI, its classes), attaches `wai-sink-<version>.aar`, and publishes it to the forge's Maven
  registry; `wai-sink-android.yml` writes and checks the publication on every change.
- **Images** (joule-code: `joule-moq-relay/deploy/`, `joule-moq-room/deploy/`): Containerfiles for
  the relay and the room service, each with a `check-image.sh` that runs the image with a read-only
  root and no capabilities and requires its user, its `--version` and its service: the relay's
  WebSocket opening answered with its first capsule, and the room service's `/health` with its
  clock's session to the relay's image up. The release's `images` job builds both, checks them and
  pushes them to the forge's container registry (`quickstart/release-images.sh`,
  `quickstart/oci-push.py`); an image that fails its check is not pushed.
- The forge's job token reads the organisation's packages and cannot write them, so the Maven
  publication and the images run only once the owner's setup exists: the repository secret
  `WAI_PACKAGES_TOKEN`, a forge token with the scope `write:package`, and for the images a runner
  labelled `oci` and the repository variable `WAI_OCI_RUNNER` set to `true`. Until then the release
  says which is missing in a notice and succeeds: the AAR is attached unpublished, and the images
  job is skipped, not queued. Everything uploads to the forge over the private network.