GET /api/v1/releases?shipped=true carries an ETag and answers a repeat with 304 until something new goes live #9129

Intent: a reader or agent that polls what went live (the story of the forge) gets an empty 304 until a new release ships, instead of the whole list every time — as /changelog.atom already answers.

Today src/http/api/releases.ts answers both the shipped list (public) and the kept releases (for whoever may read /releases) with no etag. src/http/etag.ts has weakEtag and holds; src/http/api/forges.ts shows the pattern.

Done looks like:

• [x] ?shipped=true (with or without repo) answers 200 with a weak etag computed from the exact JSON sent and cache-control: public, max-age=60; a matching If-None-Match answers 304 with no body and the same tag.
• [x] The kept releases (no shipped) carry an etag too, but cache-control: private, no-cache and vary: authorization, cookie, since they are for some readers only; a 403 carries no tag.
• [x] A test in test/ asks twice for 200 then 304 on each, records a new shipped release, and gets 200 with a new tag; an invalid shipped is still a 422 with no tag.
• [x] The route's OpenAPI description names the etag header and the 304.

Files: src/http/api/releases.ts, its OpenAPI route file, one test. Risk: never answer 304 to a reader who would now be refused; check access before comparing tags.

Reviewed pull #9135 at its head: ticked ?shipped=true (with or without repo) answers 200 with a weak etag computed from the exact JSON sent and cache-control: public, max-age=60; a matching If-None-Match answers 304 with no body and the same tag.; The kept releases (no shipped) carry an etag too, but cache-control: private, no-cache and vary: authorization, cookie, since they are for some readers only; a 403 carries no tag.; A test in test/ asks twice for 200 then 304 on each, records a new shipped release, and gets 200 with a new tag; an invalid shipped is still a 422 with no tag.; The route's OpenAPI description names the etag header and the 304..