Release: provision Nemotron and ReDimNet2 in the RC workflow

[r3dbars]

Why

build-beta.sh now exits 1 without the Nemotron 3 diarizer and the ReDimNet2 voiceprint model in ~/Library/Application Support/FluidAudio/Models. The Release Candidate runner only restores Parakeet and the pyannote diarizer from the 1.1.66 DMG, which has neither new model. So 1.1.67 can't build on the only path that notarizes.

What

• scripts/release/provision-release-models.sh <models-dir> [--previous-resources <dir>] [--redimnet2-archive <zip>] fills the cache. Every file is checked against a pinned sha256, and each .mlmodelc must match an exact file list. Any mismatch fails the job and leaves nothing half-written. No skip switch.
• New workflow step "Provision Nemotron and ReDimNet2 models" runs it before build-beta.sh. The restore step also keeps the previous DMG's nemotron-diarizer-models/ and redimnet2-voiceprint/ when they exist (1.1.68+), and the script uses them first so the bytes and Sparkle deltas stay stable.
• Docs note in docs/release-packaging.md, and a bash -n rule in .agents/test-matrix.yml.

Sources and pins

• Nemotron fast128: FluidInference/nemotron-3-diarization-coreml at 25a90f97f254428d4b30374b76af9c74fdee8327, which is the repo FluidAudio 0.17.0's Nemotron3Models.loadFromHuggingFace pulls from. Files: monolithic/v2/Nemotron3Diarizer_fast128.mlmodelc/* plus learnable_sil_emb.bin. The marker .fluidaudio-nemotron3-weights gets ga-2026-09-23\n (FluidAudio's weightsVersion). The pins match both the HF LFS sha256s at that commit and the owner's local cache.
• ReDimNet2 b4 slim: nobody else publishes a Core ML build, so it comes from a release asset on this repo, models-redimnet2-b4-slim-v1/redimnet2-b4-slim-Model.mlmodelc.zip. It's pinned per file to the owner's local redimnet2-b4-slim/Model.mlmodelc and also passes voiceprint_model_problems.

Needs before the RC run

The models-redimnet2-b4-slim-v1 release has to be published first. It needs to be a prerelease, not latest, so gh release view and the delta step keep ignoring it. Until it's up, the step fails loudly with a 404.

Validation

• Fresh run into a scratch dir (Nemotron downloaded from HF, ReDimNet2 from the zip) came out byte-identical to the local cache (diff -r / cmp clean).
• --previous-resources path with a 1.1.68-style Resources layout: installed without the network, same bytes.
• A re-run is a no-op.
• A tampered archive (one flipped byte plus an extra file) fails with both problems listed, and nothing gets installed.
• A missing release asset fails with a clear error.
• bash check.sh quick PASS, check-known-traps.py ok, SparkleAppcastDeltaTests.sh pass, YAML parses.
• The workflow itself hasn't run. source_ref has to differ from main only in Info.plist, so this has to merge first.

🤖 Generated with Claude Code

[r3dbars]

Coordinator review: APPROVE. Pinned sha256 per file + exact file lists, temp-dir build, no skip switch; Nemotron pinned to the HF commit FluidAudio 0.17.0 uses; reuse from previous DMG for 1.1.68+. Integrated via #1934.