chore(release): prepare FAT 2.0.0 for macOS, Linux, and Windows

.gitattributes

@@ -0,0 +1,2 @@
+# Runtime-data checksums must see identical bytes on every build host.
+* text=auto eol=lf

.github/PULL_REQUEST_TEMPLATE.md

@@ -17,7 +17,7 @@ Closes #
 - [ ] `cargo test --workspace`
 - [ ] `cargo test -p firmware-analysis-toolkit --test test_kernel_profile_consistency`
 - [ ] `python3 scripts/build-runtime-data-bundle.py --check`
-- [ ] `uv run mkdocs build --strict` (only if `docs/` changed)
+- [ ] Documentation links and rendered Markdown checked (if documentation changed)
 
 ## Notes
 

.github/release-build-setup.yml

@@ -0,0 +1,14 @@
+- name: Use bundled compression libraries
+  shell: bash
+  run: |
+    echo 'LZMA_API_STATIC=1' >> "$GITHUB_ENV"
+    echo 'BZIP2_NO_PKG_CONFIG=1' >> "$GITHUB_ENV"
+- name: Install license-report tool
+  uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-about@0.8.2
+- name: Stage runtime data and dependency licenses
+  shell: bash
+  run: |
+    python3 scripts/prepare-release-resources.py
+    bash scripts/generate-third-party-licenses.sh target/release-resources/third-party-licenses.json

.github/workflows/release-smoke.yml

@@ -0,0 +1,57 @@
+name: Test release archives
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+permissions:
+  contents: read
+jobs:
+  smoke:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-14
+            target: aarch64-apple-darwin
+            extension: tar.gz
+          - runner: macos-15-intel
+            target: x86_64-apple-darwin
+            extension: tar.gz
+          - runner: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            extension: tar.gz
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            extension: tar.gz
+          - runner: windows-2022
+            target: x86_64-pc-windows-msvc
+            extension: zip
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: artifacts-*
+          merge-multiple: true
+          path: artifacts
+      - name: Run packaged executable and verify bundled data
+        shell: bash
+        env:
+          VERSION: ${{ fromJson(inputs.plan).releases[0].app_version }}
+          ARCHIVE: artifacts/firmware-analysis-toolkit-${{ matrix.target }}.${{ matrix.extension }}
+        run: python3 scripts/smoke-release.py "$ARCHIVE" --version "$VERSION"
+      - name: Verify Linux archive on Fedora
+        if: runner.os == 'Linux'
+        shell: bash
+        env:
+          VERSION: ${{ fromJson(inputs.plan).releases[0].app_version }}
+          ARCHIVE: artifacts/firmware-analysis-toolkit-${{ matrix.target }}.${{ matrix.extension }}
+        run: |
+          docker run --rm -v "$PWD:/source:ro" -w /source \
+            -e VERSION -e ARCHIVE fedora:42 \
+            sh -c 'dnf -y install python3 && python3 scripts/smoke-release.py "$ARCHIVE" --version "$VERSION"'