[venkata-kishore]

Adds reusable build and release workflows for one public root Go module, npm package, or Rust crate. Release callers follow their repository's current default branch, accept Release X.Y as shorthand for X.Y.0, and validate full versions, changelog entries, commit ancestry, and immutable tags before publishing. Existing Maven workflows are unchanged.

Build and package scripts run in read-only jobs. Separate publishing jobs receive the finished artifact by immutable artifact ID and use narrowly scoped permissions. Every external action in the new workflows is pinned to the verified latest stable release's full commit SHA.

• npm publishes the same tarball to GitHub Packages, creates the GitHub tag/release, then publishes to npm using OIDC. Registry integrity and latest/next ordering are checked.
• Rust validates/packages once, creates the GitHub tag/release, then uploads the exact crate bytes through Cargo's documented registry API using a short-lived OIDC token.
• Go creates the semantic version tag/release, then verifies public proxy checksums and the exact source commit, including v2+ module paths.
• Retries restore the saved release bundle when available and reject conflicting registry bytes. Failed publishing jobs reuse their original artifact ID.

Caller examples and registry/environment setup are in docs/package-workflows.md. The release YAML is generated from .github/release-tools/ so reused workflows remain self-contained at the pinned commit; review helper sources and renderer alongside the generated files.

Validation: 27 unit tests passed; actionlint 1.7.12 passed for all six workflows (ShellCheck integration disabled); embedded Python parsing, release shell syntax, generated-file consistency, action SHA checks, and git diff --check passed. Independent review found no remaining material issues. A follow-up adversarial review added isolated Python execution and a regression test against checkout-controlled imports; documented fork-PR and caller-protection boundaries.

Live publishing and GitHub execution have not been tested. Callers must configure registry trust and environment protection before use. Monorepos, Cargo artifact dependencies, and build-metadata versions are deliberately outside this initial contract. Cargo wire-format handling needs review when the upstream publish schema changes.

• I have read and agree to the BonfireTrunk Contributor Agreement v1.