Harden release source, artifact integrity, and recovery - #210

Summary

Release preparation previously accepted an unrelated origin or feature branch, while retries trusted npm version existence without comparing the published bytes.

Require verified Git source selection, retain one approved artifact set before publication, and download and hash npm tarballs before skipping versions or advancing release discovery.

Companion cloud contract and validation handoff: https://github.com/diffexai/diffex-cloud/pull/151.

Reasoning

An npm publish cannot be safely replaced after a partial failure, so retries must reuse and verify the original artifact bytes.

The approved distribution policy currently enables npm only; the existing R2 schema remains unchanged and additional channels fail closed until their public asset verification is implemented.

Changes

• Validate canonical fetch/push origins, clean main, refreshed remote equality, stable public workspace versions, and local/remote tag absence before mutation.
• Review generated diffs, stage only intended release outputs, atomically push main and the tag, and provide recovery for rejected pushes and lost acknowledgements.
• Resolve one tag commit in CI, reject divergent recovery refs, freeze model/source inputs, and build without catalog regeneration.
• Retain private source/input manifests and reviewed npm tarballs before publishing; reuse original evidence on workflow reruns and recovery dispatches.
• Verify package identity, exact tarball URL, size, SHA-256, and SHA-512 before accepting existing npm versions or announcing a release.
• Cover partial npm publication, conflicting tarballs, unavailable artifacts, failed retention/downloads, pointer-write failures, and repeated completion.
• Update release runbooks and the mirrored cloud contract without modifying changelogs or generated artifacts.

Testing

• Reproduced the original source-selection failure through the actual release command in a temporary Git checkout with intercepted npm.
• npm run check: passed.
• ./test.sh: passed the complete isolated non-E2E suite.
• node --test scripts/*.test.mjs: passed; affected source, publication, recovery, and contract tests were rerun after refinements.
• Actionlint 1.7.12: passed for .github/workflows/build-binaries.yml.
• Cloud root and public Worker quality gates and the mirrored contract check: passed.

Git recovery tests use real local bare remotes; registry, npm, GitHub, and AWS operations use controlled fixtures, and temporary resources are cleaned up.
The credentialed release workflow was not dispatched.
Real packaging still requires the existing owner changelog regeneration prerequisite, and standalone public asset acceptance remains deferred.