[codex] Update release process sanity guidance

[k82cn]

Summary

Update docs/release-process.md and release helper targets with follow-up guidance from the v0.6.0 publish and sanity run.

Changes

• Document the flame-rs-macros publish-order issue before final flame-rs package verification.
• Fix the Python SDK verification command to install dev extras before running pytest.
• Add a Podman amd64 Rust smoke test and spell out the arm64-first exception for explicitly narrowed releases.
• Document generating compose TLS certs before the release sanity compose smoke.
• Add Makefile release image targets using the detected CONTAINER_CLI.
• Make make help include targets with digits, including e2e-*, and refresh .PHONY coverage.
• Make release-images-verify validate every platform in RELEASE_IMAGE_PLATFORMS for all four images.
• Prefer a usable Docker daemon for the default Docker-compatible CONTAINER_CLI, then fall back to Podman; keep CONTAINER_RUNTIME as a backward-compatible override alias.
• Route the remaining Makefile container recipes through CONTAINER_CLI.

CI Fix

The Python E2E and Python System Test failures on head 6cc0d282 were caused by make e2e-py-docker and make e2e-py-system-docker rendering podman compose exec on GitHub-hosted runners.

Those workflows start the cluster with docker compose up, but the runner also has Podman installed. podman info can succeed while podman compose delegates to the Docker Compose plugin and then tries to connect to /run/user/1001/podman/podman.sock, which is not running in the job.

The Makefile now prefers Docker when docker info succeeds, falls back to Podman when Docker is unavailable, and uses CONTAINER_CLI consistently for compose/build/push/run/image commands.

Validation

• git diff --check
• bash -n ci/release/sanity.sh
• python3 -c 'import py_compile; py_compile.compile("ci/release/check-image-platforms.py", cfile="/tmp/check-image-platforms.pyc", doraise=True)'
• RELEASE_SANITY_LOCAL_CHECKS=0 RELEASE_SANITY_PACKAGE_CHECKS=0 RELEASE_SANITY_REMOTE_CHECKS=0 RELEASE_SANITY_K8S_E2E=0 RELEASE_SANITY_COMPOSE_E2E=0 make release-sanity
• make help
• make -n e2e-py-docker renders docker compose exec ...
• make -n e2e-py-system-docker renders docker compose exec ...
• make -n CONTAINER_CLI=podman e2e-py-docker preserves the Podman override.
• make -n CONTAINER_RUNTIME=podman e2e-py-docker preserves the legacy alias.
• Fake GitHub-runner PATH with both docker info and podman info succeeding still renders docker compose exec ... for both Python compose targets.
• make DOCKER_TAG=v0.6.0 CONTAINER_CLI=container-cli -n release-images-verify
• make CONTAINER_CLI=container-cli -n ci-image
• make DOCKER_TAG=v0.6.0 CONTAINER_CLI=podman release-images-verify

The v0.6.0 Docker tags verify as multi-arch for all four images: linux/amd64 and linux/arm64.

Note: earlier compose/PyPI Runner smoke passed for the scoped arm64-first state after generating compose TLS certs. The current image verification reflects the later amd64 push.

[gemini-code-assist]

Code Review

This pull request updates the release process documentation to address dependency resolution for unpublished macros, add development extras to Python verification, and outline procedures for arm64-first Docker releases and TLS certificate generation. Feedback highlights two issues: the automated sanity check script ci/release/sanity.sh needs to be updated with --extra dev for consistency, and the non-existent Rust image tag 1.95 in the Podman smoke test should be replaced with a valid tag or latest to prevent command failures.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The documentation has been updated to include --extra dev for the uv run command. However, the automated sanity check script ci/release/sanity.sh at line 263 still runs uv run -n pytest ... without --extra dev. To ensure consistency and prevent the automated sanity check from failing due to missing dev dependencies, please update ci/release/sanity.sh as well.

[gemini-code-assist]

The image docker.io/library/rust:1.95 does not exist (as of current Rust releases, which are around 1.84/1.85). Running this command will fail with an image pull error. Consider using latest or a valid Rust version tag to verify the emulation. Note that there are other occurrences of 1.95 in this file (e.g., lines 410, 411, 414, 415) that should also be updated.

Suggested change

	podman run --rm --platform linux/amd64 docker.io/library/rust:1.95 rustc -vV
	podman run --rm --platform linux/amd64 docker.io/library/rust:latest rustc -vV