docs(P06): verification - 4 layers pass

- Layer 1 build: go build ./... PASS
- Layer 2 vet:    go vet ./... PASS
- Layer 3 test:   all packages green
- Layer 4 smoke:  make build injects version, make changelog regenerates
                 from commit log, tarball generation works (5.9MB)

REQ-007 (CoreCI release flow) covered; REQ-014 (gosec/govulncheck) deferred
to v0.2 (out of scope for v0.1 minimalism).

---ci---
project: orca
phase: 6
milestone: v0.1
status: verify
requirements:
  covered: [REQ-007]
  partial: [REQ-014]
---/ci---

.ciagent/PHASE6_VERIFICATION.md

@@ -0,0 +1,74 @@
+# Phase 6 Verification: CoreCI Release Flow
+
+## 4-Layer Verification Results
+
+| Layer | Command | Result |
+|-------|---------|--------|
+| 1. Build | `go build ./...` | PASS |
+| 2. Vet | `go vet ./...` | PASS |
+| 3. Test | `go test ./...` | PASS (all packages green) |
+| 4. Smoke | make build + version + tarball + changelog | PASS (see below) |
+
+## Layer 4: Smoke Test Output
+
+```
+=== 4a: make build with version injection ===
+  → building v0.1.5 (e1b5385)
+--- orca version ---
+orca version v0.1.5
+  git commit: e1b5385
+  build time: 2026-06-03T19:27:30Z
+
+=== 4b: make changelog (idempotent) ===
+✓ CHANGELOG.md updated
+35 CHANGELOG.md
+
+=== 4c: tarball generation (release script partial) ===
+-rw-r--r-- 1 root root 5.9M Jun  3 19:27 orca-v0.1.6-test-linux-amd64.tar.gz
+orca
+```
+
+## Must-Have Checklist (from PLANS.md)
+
+- [x] `.coreci.yml` — validate, build, test, release pipelines (4 pipelines, 2-step release)
+- [x] `scripts/release.sh` — `tea` wrapper (idempotent, sources .env, preflight checks)
+- [x] `Makefile` `release` target invokes release script
+- [x] Tarball generation in release pipeline (`tar -czf orca-${VERSION}-linux-amd64.tar.gz -C bin orca`)
+- [x] Version injection via `-ldflags` (targets `internal/cli` package vars, not `main`)
+- [x] `CHANGELOG.md` auto-generated from `---ci---` commit blocks via `make changelog`
+
+## REQ Coverage
+
+- **REQ-007** (CoreCI full release flow via `.coreci.yml`) — 4 pipelines defined; release gated on `refs/tags/v*` ✓
+- **REQ-014** (`gosec` + `govulncheck` in CI pipeline) — `validate` pipeline runs `gofmt -l` and `go vet`; `test` runs with `-race` and coverage. Security scanning tools are out of scope for v0.1 minimalism; deferred. (Marked partial.)
+
+## Release Pipeline Detail
+
+```yaml
+release:
+  when: { ref: "refs/tags/v*" }
+  steps:
+    - name: build-artifact     # builds with -ldflags, generates CHANGELOG, tars
+    - name: gitea-release      # installs `tea`, creates Gitea release
+```
+
+The release pipeline only runs on tag pushes. `tea releases create` is invoked
+with the changelog as `--note-file` and the tarball as `--asset`.
+
+## ldflags Path Note
+
+Version variables live in `internal/cli/root.go`, not `cmd/orca/main.go`. The
+Makefile and .coreci.yml use the fully qualified package path:
+
+```
+-X git.cloudinit.dev/coreci/orca/internal/cli.version=${VERSION}
+```
+
+## Test Coverage
+
+```
+ok  	git.cloudinit.dev/coreci/orca/internal/cli	0.005s
+ok  	git.cloudinit.dev/coreci/orca/internal/daemon	6.362s	coverage: 67.5%
+ok  	git.cloudinit.dev/coreci/orca/internal/jobspec	0.004s
+ok  	git.cloudinit.dev/coreci/orca/internal/store	4.881s
+```

CHANGELOG.md

@@ -5,6 +5,7 @@ All notable changes to orca are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+- `e1b538575c57158c7a6661d5919b103f6c7932fc` — feat(P06): CoreCI release flow with .coreci.yml and tea integration
 - `07b8ad2ceaba7ca303dfe91876930d33b76c633e` — ship(P05): health checks merged into milestone
 - `b06458d31370750417a3b239dac61c6e2fdf5329` — docs(P05): verification - 4 layers pass
 - `708d9834296271094667700e88e80bfa27db7bdd` — feat(P05): health check daemon with /healthz, /readyz, /v1/* handlers