fix(release): harden artifact assembly verification

[yaacovcorcos]

Summary

• Anchor updater manifest handling to real Electron Builder 26.15.6 output.
• Preserve file-entry metadata such as blockMapSize during parse and merge.
• Verify Linux x86_64 artifacts and strictly validate blockmap sidecars.
• Exclude internal builder metadata from release assets.
• Add golden manifests, an Electron Builder version tripwire, verifier regressions, and release smoke coverage through handoff creation.

Validation

• Focused release tests: 26 passing.
• Release smoke test passing.
• @t3tools/scripts typecheck passing.
• Focused lint and formatting passing.
• Real artifacts from failed run 31399428138 pass the updated verifier.
• Full scripts sweep: 309 tests passed; one unrelated pre-existing suite fails because .github/scripts/thread-transfer-report.test.cjs has no test suite.

No release publication is performed by this change.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.4 KiB	11.3 KiB	−19 B (−0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−21 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+7 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+4 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+3 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: f600ec1 · PR result: 67ad15a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.