M2: Initial capability release

Drafted with AI assistance; reviewed by @andunn.

Tracks milestone M2 of the plan epic. A merged MR advances a checkbox; this tracker closes only on maintainer review of the whole milestone.

A consumer can pin a version and trust it.

• A semver release is cut through the release lane
• The component is listed in the CI/CD Catalog and installable from it
• The tracked STIG release's path and version are single-sourced in the repository
• The demonstration consumes a released version under a working non-human identity, green end to end
• Bryan's review and approval obtained before the v1.3.0 tag is cut (no tagging without his eyes; recorded 2026-08-21)

Part of &1