[Pepps233]

Summary

Make release publication enforce the stored-record contract and add matching fixtures for the future Diffex latest-version consumer.

Companion cloud PR: https://github.com/diffexai/diffex-cloud/pull/144.

Reasoning

The real publisher command previously accepted --source-commit not-a-commit and wrote release records in the controlled reproduction.

It now rejects malformed release identities before writing and validates existing records before trusting their versions or reusing immutable records.

The public contract means verified npm availability, without claiming that GitHub binary assets are already public.

Changes

• Add strict stored-record and public-response validators, covering canonical stable versions, exact CLI identity, unique lockstep packages, commit, timestamp, HTTPS URLs, and SRI metadata.
• Apply record validation to publisher writes and storage reads while preserving conditional latest updates and immutable-record recovery.
• Add matching cloud/CLI contract documentation, fixtures, publisher command regressions, and consumer conformance tests.
• Use structurally valid synthetic integrity metadata in the existing publication harness.

This deliberately tightens acceptance of malformed stored records; it adds no dependency or schema migration.
The production checker still uses its existing endpoint and parsing until the separately planned consumer migration connects the new validator.
Existing update-note behavior is preserved.

Testing

• Before implementation: node --test --test-name-pattern='noncanonical source commit' scripts/publish-release-announcement.test.mjs failed because the publisher exited successfully.
• node --test scripts/release-contract.test.mjs scripts/publish-release-announcement.test.mjs: 130 tests passed, including actual publisher output and rejection of every invalid stored-record fixture.
• From packages/coding-agent, node ../../node_modules/vitest/dist/cli.js --run test/release-contract.test.ts: 23 tests passed.
• npm run check and ./test.sh: passed.
• Both cloud quality gates and the cross-repository document/fixture comparison: passed.

The controlled publisher uses mocked npm and intercepted storage, with temporary-fixture cleanup.
There is no deployed R2-to-HTTP-to-CLI E2E path in this contract change, and no real release or remote storage write was performed.

[Pepps233]

large diff due to this test file.