fix(platform): coherent linux-arm baseline and release tag/version validation

[samchon]

Bundle b11 — linux-arm ARM baseline + release tag/version validation

Part of the repository-audit-2026-07 campaign (tracker #667 / #682). Two independent P1 platform/release correctness fixes.

RA-06 — one coherent ARM baseline in @ttsc/linux-arm (#667)

@ttsc/linux-arm bundles the linux-armv6l Go SDK but cross-compiled its ttsc/ttscserver/ttscgraph executables with no GOARM, which the current toolchain defaults to ARMv7. The SDK and executables then targeted different ARM generations, so ARMv6 hardware could install a package whose primary executables might not run.

• New scripts/platform-target.cjs::resolveGoTarget resolves one coherent Go target record per platform package, tying GOOS/GOARCH/GOARM to the bundled SDK archive suffix.
• scripts/build-platform-package.cjs now forces GOARM=6 for all three arm executables and derives the archive target from the same record (single source of truth).
• README documents the ARMv6 baseline contract; the broad npm arm CPU contract is preserved (no support-boundary narrowing).

RA-08 — validate release tag and package versions before publication (#682)

release.yml triggers on every pushed tag (on.push.tags: ["*"]) and publishes to the VS Code Marketplace and npm before any tag-derived smoke test runs, so a malformed tag or a tag/manifest version mismatch could create irreversible external releases and only then fail.

• New scripts/release-preflight.cjs runs as the first release step, before build and any publication. Side-effect free (reads files, never mutates a registry).
• Validates: tag is exactly v${version} for a valid semver (prerelease allowed); every non-private packages/* manifest (the exact set package:latest:publish publishes) carries that version; the @ttsc/vscode manifest that names the VSIX/Marketplace artifact agrees.
• release.yml invokes the preflight before pnpm run build, the Marketplace publish, the npm publish, and any credential use.

Tests

• test_platform_target_matrix_pins_linux_arm_to_armv6 — asserts the resolved matrix pins linux-arm to GOARM=6 / linux-armv6l and that arm64 / non-ARM negative twins never acquire a GOARM; structural guard that all three executables flow through one buildGoTarget.
• test_release_preflight_rejects_incoherent_tag_and_versions — synthetic workspaces exercised via the real script: canonical + prerelease pass; malformed tag, missing v, tag/manifest mismatch, per-package npm skew, VSIX skew, and missing @ttsc/vscode all fail with the offending reason. Private package proven skipped; no case mutates state.
• test_release_workflow_runs_preflight_before_publication — locks workflow ordering: preflight appears exactly once and strictly before build, both publishes, and credential use.

Closes #667, #682

[samchon]

Self-Review — round 1

Reviewed the whole declared surface of both fixes against the development contract (Consequence Analysis, Testing contract, Forbidden list).

RA-06 (ARM baseline)

• Verified every arch/archive mapping in build-platform-package.cjs now flows through the single resolveGoTarget record — grepped the script: no residual armv6l/amd64 literals remain; the only surviving npmOs === 'win32' branches are OS file-extension logic (.exe, go.exe, .zip vs .tar.gz), not arch-baseline decisions, so they correctly stay OS-keyed.
• resolveGoTarget printed for all seven real targets: linux-arm => GOARM=6 / linux-armv6l; arm64, amd64, darwin, windows negative twins carry no GOARM and keep their own archive. Matches the pre-change mappings exactly except the intended GOARM=6 addition.
• GOARM is injected only when present (...(goarm ? { GOARM: goarm } : {})), so non-arm builds are byte-identical to before. Broad npm arm CPU contract and bundled linux-armv6l SDK preserved; no support-boundary narrowing (stayed in scope).
• Test locks the seam (matrix + negative twins + structural guard that all three executables flow through one buildGoTarget). Full go version -m binary inspection needs a cross-compile + SDK download / emulator and is left to CI/release per the issue's acceptance note.

RA-08 (release preflight)

• Confirmed the preflight's package selection (non-private packages/*) is exactly the set package:latest:publish publishes (pnpm --filter=./packages/* -r publish skips private; ttsc is under packages/*). All 19 publishable packages plus @ttsc/vscode are non-private at one lockstep version.
• Exercised the real workspace: v0.18.4 => exit 0 (19 packages); v0.19.0 mismatch => exit 1; v0.18.4-rc.1 prerelease-mismatch => exit 1; nightly malformed => exit 1. Side-effect free (reads files only).
• Workflow ordering test asserts preflight runs once and strictly before build, both publishes, and VSCE_PAT credential use.
• Registry-existence detection deliberately deferred to the publish step to keep the gate offline and unit-testable — documented in the script header and consistent with the issue's 'where practical' language.

Result: no findings requiring remediation. All three focused tests green on win32; scripts pass node --check; assert:platform-packages still exits 0. Clean round — no round 2 needed.

[samchon]

Final verification (local, win32)

# Focused test suite (both fixes)
TTSC_TEST_DIR=features pnpm --filter @ttsc/test-ttsc start --   --include=test_platform_target_matrix_pins_linux_arm_to_armv6,test_release_preflight_rejects_incoherent_tag_and_versions,test_release_workflow_runs_preflight_before_publication

=> Success (3/3):

• test_platform_target_matrix_pins_linux_arm_to_armv6: 3 ms
• test_release_preflight_rejects_incoherent_tag_and_versions: 1,318 ms
• test_release_workflow_runs_preflight_before_publication: 0 ms

# Preflight against the real workspace
node scripts/release-preflight.cjs --tag v0.18.4     => exit 0 (19 packages)
node scripts/release-preflight.cjs --tag v0.19.0     => exit 1 (version mismatch)
node scripts/release-preflight.cjs --tag v0.18.4-rc.1 => exit 1 (prerelease mismatch)
node scripts/release-preflight.cjs --tag nightly     => exit 1 (missing leading 'v')

# Platform package assertions unaffected
pnpm run assert:platform-packages (assert-platform-package.cjs --source) => exit 0

# Syntax
node --check scripts/{build-platform-package,release-preflight,platform-target}.cjs => OK

Both issues implemented and verified. Marking ready. Do NOT merge — lead merges after recheck.

[samchon]

Squash-merged as 32b57a63a1f378f989f7ab6bfaee389d43cc4a44. The merge-commit CI was cancelled by exact SHA per campaign discipline (CI stays suspended for the duration of the audit). Lead handles worktree/branch cleanup.