[Chris-Wolfgang]

Summary

Refs #179 (documentation half) and #328 (its REPRODUCIBLE-BUILD.md acceptance item). Top of the CI series; stacked on #365 (merge #341 -> ... -> #365 first). After this merges, #179 and #328 need a manual close.

• docs/REPRODUCIBLE-BUILD.md (new, adapted from ETL-Transformers): the guarantee (every TFM's .dll in the .nupkg and .pdb in the .snupkg are byte-identical on Linux and Windows for the same SDK; the package files are not, because NuGet stamps the pack time), how it is achieved (table pointing at Directory.Build.props / Directory.Build.targets from build: byte-identical .dll/.pdb across operating systems (#328) #364), the cross-OS CI check, the reproducible-build-manifest.json release asset from ci(release): attach a reproducible-build manifest to every release (#179) #365, a copy-paste verification procedure, how to file a discrepancy (an issue with a fixed title and the evidence to attach), and how to publish a third-party attestation (Reproducible Builds conventions / a signed statement, linked from an issue). It says that v1.1.2 and earlier have no manifest.
• README: new "Verify the build" section linking the doc and SECURITY.md (acceptance item for [Maintenance] security: Reproducible-build third-party verification (consumer side) #179).
• SECURITY.md: the supply-chain section from docs(security): how consumers verify a release (#163) #363 gains "4. Reproducible build".

Verification

Verified locally; CI blocked by the account billing lock.

• Docs-only change.
• The verification snippet passes bash -n, and its hashing and manifest-extraction lines were run against a real pack plus the manifest produced by ci(release): attach a reproducible-build manifest to every release (#179) #365's step: diff released.txt mine.txt was empty ("Reproduced"). That run found two portability issues that the doc now handles: Git for Windows' sha256sum prints a * binary marker, and Windows jq -r emits CRLF.
• The cross-OS claim is what build: byte-identical .dll/.pdb across operating systems (#328) #364's workflow enforces; it could not be run locally (no Linux SDK here).

🤖 Generated with Claude Code