Sprint 10.4 — Verify reproducible release artifacts

[maruson08]

Problem / motivation

Release artifacts must be traceable to one source commit and reproducible from a clean locked toolchain.

Scope

• isolate release builds from stale files
• verify browser artifact and canonical npm payload reproducibility
• identify any unavoidable tar-layer nondeterminism precisely
• generate a machine-verifiable SHA256SUMS manifest associating version, commit, filename, and digest

Non-goals

• fake equivalence or timestamp-based artifacts
• general release framework

Acceptance criteria

• two clean builds produce byte-identical controllable artifacts
• SHA-256 manifest verifies successfully
• any nondeterministic layer is documented accurately