Add release notes to `2026.07.12`

https://github.com/canonical/spread/releases/tag/2026.07.12 is currently
published with an empty body since there is no previous tag to easily diff against. ive tracked down then previously published snap sha to [52e4138](https://github.com/canonical/spread/commit/52e4138e9bf389af967648f3bf45a53c23cca8e7) and written example release notes (below). Would be cool to add them to the release?

---

This is the first tagged release of Spread, and the first snap published to the store since 2018. There is no previous tag to diff against, so the changes below are measured from [`52e4138`](https://github.com/canonical/spread/commit/52e4138e9bf389af967648f3bf45a53c23cca8e7) (2018-08-20), which is the commit the last published snap (revision 41, version `2018.08.30`) was built from.

## Install

```shell
snap install spread
```

or

```shell
go install github.com/canonical/spread/cmd/spread@2026.07.12
```

## Breaking changes

- The `residue` task field is now `artifacts`, and the `-residue` command line flag is now `-artifacts`. Task definitions and invocations using the old names must be updated.
- The Go import path moved from `github.com/snapcore/spread` to `github.com/canonical/spread`. Anything importing the packages directly, or installing with `go install`, needs the new path.
- The QEMU backend now invokes `qemu-system-x86_64 -enable-kvm` instead of `kvm`, which makes it work on distributions that do not ship the `kvm` wrapper. Hosts that only provide `kvm` are no longer supported.
- Artifacts are now fetched as a gzip tarball rather than an xz one.

## New backend

- **OpenStack.** Distributes tasks to an OpenStack environment via version 3 of the identity API on the default domain. Configured with `endpoint`, `account`, `key`, `location` (as `project/region`), and optional `networks` and `groups`; images are matched exactly by name first, then by the most recent partial match. See the OpenStack section of the README for a worked example. (#170, #231)

## New features

- Several settings that were previously backend-wide can now be set per system, and cascade from the backend when unset: `storage`, `plan`, `networks`, and `groups`.
- `secure-boot` on a Google system enables Shielded VM secure boot, vTPM, and integrity monitoring. (#104)
- `bios: uefi` on a QEMU system boots the guest through OVMF. The firmware is looked up in `~/.spread/qemu/bios/`, then `$SPREAD_QEMU_FALLBACK_BIOS_PATH`, then `/usr/share/OVMF/OVMF_CODE.fd`, so distribution packaging can point at its own path.
- - `cpu-family` requests a specific CPU family for a system; on Google it maps to `minCpuPlatform`. (#113)
- `NOMATCH` script helper, the inverse of `MATCH`: fails and prints the input when the pattern is found. (#88)
- `reroot` on a project specifies a relative path to a new project root before repacking. (#206)
- Server labels are now included in the Spread output.

## Fixes

- Reboots are detected by comparing `/proc/sys/kernel/random/boot_id` rather than by watching uptime move, which removes a class of false negatives on fast-rebooting systems, and `dialOnReboot` no longer hangs when the remote stops replying.
- LXD: the container address is no longer read from a hardcoded `eth0`, the right instance is picked out of the `lxc list` output instead of assuming the first, SSH password authentication is re-enabled where `livecd-rootfs` disabled it via `/etc/ssh/sshd_config.d`, and the address wait timeout was raised from 30s to 60s. (#178, #181, #184)
- Google: the image cache is marked ready only after it has been populated, and string and file credentials are now parsed the same way. (#175, #280)
- Artifact fetching uses `tar -C` instead of `cd`, avoiding a directory reset under sudo. (#190)
- `OptionalInt.String` passed base 64 to `strconv.FormatInt`; it now passes 10. (#117)
- Assorted backend fixes: invalid Humbox backend location check, QEMU BIOS path check.

## Packaging and build

- The snap moved to `base: core24`, declares `license: GPL-3.0-or-later`, and derives its version from the build with `adopt-info`, so it is now `-g` rather than a hardcoded string.
- The build moved to Go modules, targeting Go 1.23. (#129, #281)
- CI moved from Travis to GitHub Actions, with Spread's own test suite running against the LXD, QEMU, and Google backends, and Renovate keeping dependencies current. (#189)
- Unit test coverage was added for the Google, LXD, QEMU, OpenStack, and client code paths.
- Dependency updates, including `golang.org/x/net` to v0.38.0 for a security fix, and the removal of the deprecated `io/ioutil` and `crypto/ssh/terminal` imports. (#208, #210, #211, #220)

## Contributors

Michael Vogt (@mvo5), Sergio Cazzolato (@sergiocazzolato), Zygmunt Krynicki (@zyga), Claudio Matsuoka (@cmatsuoka), Gustavo Niemeyer (@niemeyer), Maciej Borzecki (@bboozzoo), Chris Patterson (@cjp256), Brett Holman (@holmanb), Manuel de la Peña (@mdelapenya), Nicolas Bock (@nicolasbock), Stuart Warren (@stuart-warren), and @thp-canonical.

**Full changelog**: https://github.com/canonical/spread/compare/52e4138...2026.07.12

Open the 2026.07.12 GitHub release and compare it with commit 52e4138, the previous snap's source. Add the release notes supplied in this issue to the empty release body, preserving the installation, changes, fixes, packaging, contributor, and changelog sections; done means the published release displays those notes.

Written by the indexing model from the issue text.