Function build 

pub fn build(
    contract: &Contract,
    facts: &Facts,
    head_sha: &str,
    version: &str,
) -> ReleasePlan

Build and seal a ReleasePlan from an already-normalized contract and detected facts, at git head_sha, for the chosen version.

The caller (the ossctl-cli handler behind release plan, or the release coordinator re-deriving current state) is responsible for having normalized the contract and gathered the facts through the same code paths behind contract show / facts — this function never re-parses OSS-RELEASE.md nor re-derives facts. version is treated as an opaque, already-validated identifier (scheme-specific validation — semver vs a calver pattern — is the contract’s/skill’s job, not the plan’s).