Walk NIST SSDF Phase 5 (Release) and file GitHub epics for the three release practices — PS.2 verifying software release integrity (signing, checksums, provenance), PS.3 archiving each release and producing an SBOM, PW.9 shipping secure settings by default. Use when preparing or auditing a release process, adding artifact signing or SBOM generation, reviewing default configuration for insecure defaults, or when the user mentions NIST SSDF, SP 800-218, SSDF phase 5, SBOM, or the PS.2/PS.3/PW.9 practices.
