Enhance server diagnostics, resource limits, and SQL conformance

.github/ISSUE_TEMPLATE/release-signoff.md

@@ -0,0 +1,46 @@
+---
+name: Release Sign-Off
+about: Production release readiness checklist and approvals
+title: "release(signoff): vX.Y.Z readiness"
+labels: ["area/release", "area/ops"]
+assignees: []
+---
+
+## Release Metadata
+
+- target version:
+- target date:
+- release owner:
+- rollback owner:
+
+## Automated Gate Evidence
+
+- [ ] `Release Gate` workflow passed on target commit
+- [ ] `cargo check --locked` passed
+- [ ] `cargo test --lib --locked` passed
+- [ ] `./tools/ci/run_integration_tests.sh` passed
+- [ ] `./tools/release/check_critical_blockers.sh` passed
+
+## Engineering Sign-Off
+
+- [ ] Schema/storage compatibility risk reviewed
+- [ ] Known high-severity defects triaged and dispositioned
+- [ ] Upgrade notes completed
+- [ ] Rollback procedure validated
+- approver:
+- approval date:
+
+## Operations Sign-Off
+
+- [ ] Runbook updated for this release
+- [ ] Monitoring/alerts reviewed
+- [ ] Capacity/performance risk reviewed
+- [ ] Backup/restore posture reviewed
+- approver:
+- approval date:
+
+## Decision
+
+- [ ] APPROVED FOR RELEASE
+- [ ] BLOCKED
+- blocking notes:

.github/workflows/ci.yml

@@ -2,19 +2,46 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, staging]
   pull_request:
 
+env:
+  CARGO_TERM_COLOR: always
+
 jobs:
-  lint-test:
+  quality:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@v2
       - name: Format check
         run: cargo fmt --all --check
       - name: Clippy
-        run: cargo clippy --all-targets --all-features -- -D warnings
-      - name: Tests
-        run: cargo test --all-targets --all-features
+        run: cargo clippy --all-targets --all-features -- -W clippy::all
+
+  unit-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@v2
+      - name: Library tests
+        run: cargo test --lib --locked
+
+  integration-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@v2
+      - name: Integration and test-target coverage gate
+        run: ./tools/ci/run_integration_tests.sh

.github/workflows/release-gate.yml

@@ -0,0 +1,35 @@
+name: Release Gate
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  issues: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  release-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@v2
+      - name: Cargo check
+        run: cargo check --locked
+      - name: Library tests
+        run: cargo test --lib --locked
+      - name: Integration tests
+        run: ./tools/ci/run_integration_tests.sh
+      - name: Critical blocker gate
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: ./tools/release/check_critical_blockers.sh