feat: package atomic reversible nginx releases

scripts/build-release.d.mts

@@ -0,0 +1,17 @@
+export interface BuildReleaseInput {
+  distDir: string;
+  signedManifestPath: string;
+  sbomPath: string;
+  outputPath: string;
+  verifierModulePath: string;
+  trustPolicyPath: string;
+  protectedState: Record<string, unknown>;
+  now: string;
+  verifySignedReleaseEnvelope?: (input: any) => any;
+}
+
+export function buildReleasePackage(input: BuildReleaseInput): Promise<{
+  releaseId: string;
+  manifestDigest: string;
+  archivePath: string;
+}>;