fix: add production runtime RC release channel

Publish signed prerelease artifacts from v2.0.0-rc.* tags, bind bootstrap trust to the immutable RC tag, make missing-release errors actionable, and install the six public skills from the canonical subpath.

docs/gstack-2/ARCHITECTURE.md

@@ -85,7 +85,7 @@ judgment. This prevents an alias from drifting away from the canonical source.
 The standard Agent Skills tree is the unit of distribution:
 
 ```bash
-npx skills add time-attack/gstack
+npx skills add time-attack/gstack/skills
 ```
 
 The installer—not GStack—owns host detection, project/global scope, destination

docs/gstack-2/HOST-COMPATIBILITY.md

@@ -18,7 +18,7 @@ bundle.
 ## Canonical installation
 
 ```bash
-npx skills add time-attack/gstack
+npx skills add time-attack/gstack/skills
 ```
 
 The standards installer owns host detection, destination paths, project/global
@@ -32,7 +32,7 @@ Examples supported by the installer interface:
 npx skills add time-attack/gstack/skills --skill qa
 
 # Installer-managed global scope
-npx skills add time-attack/gstack -g
+npx skills add time-attack/gstack/skills -g
 ```
 
 Run `npx skills add --help` for the installed CLI version before scripting

docs/gstack-2/JUDGMENT-PROVENANCE.json

@@ -4552,7 +4552,7 @@
       "source_path": "gstack-upgrade/SKILL.md.tmpl",
       "base_sha": "bb57306d98c97011b0919c6132705a15b1579781",
       "blob_sha": "5402a1da3c857cbf50668085fce53172b72bba0d",
-      "normalized_render_sha256": "a913cf77f76c4d68c576a06190b498e3d8d3b60b85498a68f173b23a7f800828",
+      "normalized_render_sha256": "2c8cf9e505b7da27730bf646a33ee38e8092259f3335a524c71e57ba5b602541",
       "target": "skills/ship/references/legacy/gstack-upgrade.md",
       "disposition": "DUPLICATE_INFRASTRUCTURE",
       "overlays": [

docs/gstack-2/RELEASE-INTEGRITY.md

@@ -5,10 +5,11 @@ GStack has two explicit version identities during the 2.0 migration:
 - `VERSION` and `package.json.version` are the repository/package release
   counter. They remain byte-equal and retain the existing four-slot format so
   the 1.x compatibility ship queue does not silently fail open.
-- `package.json.gstack.runtimeVersion`, `runtime/index.js`,
-  `runtime/install.js`, and every standards-installed bootstrap declare the
-  managed-runtime protocol release `2.0.0`. The official artifact tag and
-  manifest use that value.
+- `package.json.gstack.runtimeVersion`, `runtime/index.js`, and
+  `runtime/install.js` declare the managed-runtime protocol release `2.0.0`.
+  Each standards-installed bootstrap separately pins one immutable artifact
+  release tag. Candidate bootstraps use `v2.0.0-rc.N`; the manifest and bundle
+  remain runtime-compatible with `2.0.0`. Stable bootstraps use `v2.0.0`.
 
 They are intentionally different namespaces. CI fails if either identity
 drifts inside its own namespace.
@@ -24,6 +25,14 @@ linux-arm64   linux-x64   (glibc)
 windows-arm64 windows-x64
 ```
 
+Both `v2.0.0-rc.*` and `v2.0.0` tags use the same build, signing, manifest,
+attestation, and smoke path. RC tags publish GitHub prereleases so the exact
+fresh-machine production bootstrap can be exercised before the stable tag is
+created. Runtime compatibility and release-channel identity are deliberately
+separate: archive names and manifest `version` remain `2.0.0`, while URLs and
+Sigstore certificate identity bind to the immutable RC or stable tag that
+actually published them.
+
 Each archive has one `gstack/` root and no symlinks. CI records an exact byte
 count and SHA-256, signs the archive keylessly with Cosign, emits a Sigstore
 bundle, and also creates a GitHub build-provenance attestation. The release

docs/gstack-2/UPGRADE-AND-ROLLBACK.md

@@ -10,7 +10,7 @@ Install the canonical Agent Skills source, then use that installer's tracked
 source and lock metadata for discovery, updates, and removal:
 
 ```bash
-npx skills add time-attack/gstack
+npx skills add time-attack/gstack/skills
 npx skills update              # interactive scope
 npx skills update -p           # project installs only
 npx skills update -g           # global installs only