What signing in for tcm asks to be allowed: writing its records (releases, reviews, advisories, yanks), and nothing else. One sign-in does for announcing and attesting.
Announce a release of this codebase as the signed-in account, fetched from `sources`, and say so: where the record is, and which sources don't have the release yet (it's announced anyway; a push sends it).
Write a release's record to the signed-in account's repository. A version is one record: announced again, it's left as it is when it says the same, has its sources replaced when only they differ, and is refused when it names something else.
Where a package's release is announced as fetched from: the `--source` URLs given (kept for next time), else the ones kept, else origin, if it's a server.
The releases an account has announced: its `codes.tcm.release` records, read from the PDS its DID document names. A record that isn't one, or isn't at its own key (`<package>:<version>`), is left out.
An announced release: `what` (`geo@1.2.0`, or `geo` for its highest version) among those `who` (a handle, checked both ways, or a DID) has announced, as their repository signs it (`signedRecord`: what a PDS lists isn't taken on its word).