[callumalpass]

Summary

• Bind the canonical staging NEXT trust asset to the exact beta.138 image source 4bfbb768a1a40e3d086f4c480ecc1b59e44ca177 (merged Prepare v0.1.0-beta.138 #930, containing Let unfreeze supersede an accepted, never-started zero-hosted cohort revision #929).
• Refresh issue time only; preserve staging roots, policy keys, root-signed certificates, environment, schema and CP/log origins byte-for-byte.
• Update the exact staging preparation fixture and release notes/documentation. Production and LAB assets are unchanged.

Exact preparation pins

• Release: v0.1.0-beta.138
• Source Server CI: 39744032763; successful merge-queue qualification: 39742565982
• Selected original image publication: 39744074141; actual successful publication/attempt and original signed evidence remain independently mandatory before protected trust publication.
• Asset: config/next-trust/staging.json, 853 bytes
• SHA-256: f422b5a8d2584ddb5b7d786df314e61650a603edbf77a2214cce17bf2014a359
• issued_at: 1792655974203

Validation

• rpnpm --node 24.19.0 test:release-trust — 42/42 PASS.
• Canonical compact recursively sorted JSON; only source and issued_at differ from the prior staging payload. Independent staging root/policy/certificate bytes unchanged.
• git diff --check — PASS; exactly four preparation files.

Preparation is not published trust or deployment evidence. After normal review/merge-queue qualification, the protected staging-trust publisher authenticates the exact original image bundle and qualifies the final producer before signing; normal independent Ops verification remains mandatory. No new keys, signatures, trust anchors, production authority or runtime mutation.