fix(release): verify Windows worktree content

[slashdevcorpse]

Summary

• replace the desktop builder duplicate git status --porcelain gate with the shared fail-closed release worktree verifier
• keep canonical tracked-change, unexpected-untracked-file, Git-error, and raw bun.lock digest rejection intact
• add a release-smoke contract preventing the Windows stat-only porcelain regression

Failure addressed

Windows prerelease run 29717551487 passed source and lockfile provenance, then failed because root bun install --frozen-lockfile rewrote apps/web/public/mockServiceWorker.js to the exact committed LF bytes. On Windows, porcelain retained a stat-only M even though the HEAD blob, index blob, worktree hash, and SHA-256 all matched and git diff --quiet HEAD returned clean.

The failed super-v0.5.5-super.2 tag remains immutable evidence; the next qualified release will use .3.

Verification

• focused Vitest: 23/23
• workflow contract validator: passed
• release smoke: passed
• exact native release command clears the former guard and reaches Windows NSIS construction
• tracked mutation and unexpected untracked input behavior remains fail-closed
• worktree and diff checks: clean

---

Summary by cubic

Switch desktop release cleanliness checks to the content-aware verifyReleaseWorktreeCleanliness to fix Windows stat-only false positives while keeping strict provenance and bun.lock digest validation.

• Bug Fixes
  • Replace git status --porcelain guard with verifyReleaseWorktreeCleanliness(repoRoot) to verify content, not file stats.
  • Add release-smoke assertions to require the new verifier and prohibit porcelain-based checks on Windows.
  • Exact-provenance build now reaches Windows NSIS when worktree content matches HEAD.

^{Written for commit 9819a2a. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Improved desktop release validation by consistently checking that the working copy is clean before staging artifacts.
  • Strengthened release smoke checks to detect invalid worktree validation behavior, including Windows-specific status entries.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Release worktree validation

Layer / File(s)	Summary
Centralize release worktree validation scripts/build-desktop-artifact.ts	Release staging imports and invokes verifyReleaseWorktreeCleanliness(repoRoot) while retaining BuildScriptError handling.
Validate staging authority scripts/release-smoke.ts	Smoke checks require the shared validator call and ensure the build script no longer uses the --porcelain=v1 check.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: emanuele-web04

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main release-worktree fix and its Windows focus.
Description check	✅ Passed	The description covers what changed, why, and verification, even though it uses different headings than the template.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}