Complete production roadmap: vault, peers, swarm, streams, ops

Ship remaining roadmap items: encrypted registry vault, peer invite/revoke,
Swarm/plugins behind flags, binary streams, engine create validation, deploy
rollback, schema validation, fleet/access UI, metrics, fuzz/load/soak tests,
systemd packaging, and release tooling. Mark ROADMAP fully complete.

docs/RELEASE.md

@@ -0,0 +1,68 @@
+# peardock release process
+
+## Server tarball + checksums
+
+```bash
+chmod +x scripts/release-checksums.sh
+./scripts/release-checksums.sh dist/
+# Optional GPG:
+GPG_KEY_ID=YOUR_KEY_ID ./scripts/release-checksums.sh dist/
+```
+
+Artifacts:
+
+| File | Purpose |
+|------|---------|
+| `peardock-<ver>-<stamp>.tar.gz` | Source/runtime tree (no node_modules) |
+| `*.sha256` | SHA-256 checksum |
+| `*.asc` | Detached GPG signature (if keyed) |
+
+Verify:
+
+```bash
+cd dist
+sha256sum -c peardock-*.sha256
+gpg --verify peardock-*.tar.gz.asc peardock-*.tar.gz   # if signed
+```
+
+## Server install from release
+
+```bash
+tar -xzf peardock-*.tar.gz -C /opt/peardock
+cd /opt/peardock && npm ci --omit=dev
+cp deploy/peardock.service /etc/systemd/system/
+systemctl enable --now peardock
+```
+
+## Pear desktop app
+
+```bash
+npm ci
+pear stage .
+pear release .
+# Distribute pear:// link or channel per Pear docs
+```
+
+## Certification soak (24h)
+
+```bash
+# Terminal 1
+npm run server
+
+# Terminal 2 — 24 hours
+SOAK_DURATION_MS=86400000 npm run soak
+# or: node scripts/soak.js --hours 24
+```
+
+Exit 0 = Docker remained reachable within failure threshold.
+
+## Load / fuzz in CI
+
+Included in `npm test`:
+
+- `test/load.test.js` — concurrent HyperDHT pings  
+- `test/fuzz.test.js` — schema/role fuzz  
+
+## Encoding profile
+
+Handshake returns `schemaVersion` and features. Default encoding remains JSON (`shared/encodings.js`); binary bulk uses `binaryStream*` + `push:binaryChunk`. Hyperschema can replace JSON value encodings without renaming methods.