feat: build and install Seriatim from source

README.md

@@ -4,8 +4,8 @@ Installs the [Seriatim](https://gitea.maximumdirect.net/eric/seriatim)
 transcript processor from source. The role supports Ubuntu 26.04 on `amd64`
 and `arm64` hosts and is independently usable outside the D&D pipeline role.
 
-The role manages its build dependencies and a root-owned source checkout. At
-this point binary installation is added by subsequent implementation work.
+The role manages its build dependencies and a root-owned source checkout,
+builds a native static executable, validates it, and safely installs it.
 
 ## Requirements
 
@@ -49,6 +49,29 @@ provided independently through the managed host's Git configuration or SSH
 environment; this role does not manage credentials or accept unknown host
 keys.
 
+## Build and installation behavior
+
+Builds run from the selected checkout with `GOWORK=off`,
+`GOTOOLCHAIN=local`, `CGO_ENABLED=0`, the configured ordered build flags, and
+the upstream version-injection linker flags. The resulting executable is
+staged and must report the exact configured version before it atomically
+replaces `seriatim_binary_path`. It is installed as `root:root` mode `0755`.
+
+The role records readable inputs, their SHA-256 fingerprint, and the installed
+binary checksum beneath `seriatim_build_state_dir`. A source commit, compiler
+identity, Go path, version, flags, linker flags, package, or fixed environment
+change triggers a rebuild. Missing or corrupt state, a modified binary, or an
+incorrect installed version also triggers rebuilding. Failed compilation or
+staged validation leaves the previous installed binary and successful state
+untouched.
+
+For example, development from a branch must identify both source and output:
+
+```yaml
+seriatim_source_ref: feature/example
+seriatim_build_version: v1.5.0-dev
+```
+
 ## Static validation
 
 ```sh