# Does a REAL release (scripts/build-release.sh) carry the Go install payload
# (bin/whp-privd and BOTH bin/whp-pam-check.el9 / .el10, each with its .sha256)?
#
#   disabled  PHP-only release, exactly as before (bin/ holds whp,
#             whp-filemanagerd, whp-mailproxy only). The default.
#   enabled   the release ships the Go payload (whp, whp-privd, both pam-check variants)
#             built by CI (.gitea/workflows/build-go-payload.yaml), fetched from the
#             registry and verified against scripts/go-payload.pins, behind the five-point gate.
#
# This is a committed marker, not an environment variable or a flag: nobody
# can skip the gate for one build, and nobody can switch it on by accident.
# Flip it to `enabled` in a reviewed commit only after every box of the
# "Release gate for whp-privd + whp-pam-check" list in docs/go-port/README.md
# is ticked with evidence (both digests in scripts/pam-build-image.pin and the CI pins in scripts/go-payload.pins recorded,
# both variants measured on the build server, two equal builds seen).
# Any other content makes build-release.sh abort.
enabled
