fix(smoke): hand the verifier the package's archive and digest as one readable release pair

The split deploy smoke failed in CI with "The SHA-256 file could not be read."
BuildKit's local exporter creates its output directory (`--output
type=local,dest=$work/module-package`) with mode 0700, owned by whoever ran the
build. That directory was mounted into the verifier, which runs as the image's
unprivileged `node` user (uid 1000). In CI the build runs as root, so the
directory was root:root 0700 and the verifier could read neither file; the
digest file is simply read first. On a workstation the build runs as uid 1000,
the same uid as `node`, so it was readable by coincidence.

scripts/lib/module-package-release.sh turns one build's output into the release
pair: it requires exactly one archive and its .sha256 and nothing else, checks
that the digest line names that archive, then creates a fresh directory that
must not exist yet (0755) and copies both files into it (0644). The smoke stages
and mounts only that directory; BuildKit's output directory is never mounted.
Archive-digest verification stays mandatory: the verifier still reads the
.sha256 file. Nothing in the verifier changed.

Tests: the helper is driven in bash against a 0700 build output, and refuses a
missing, malformed, or mismatched digest, stray output, a second archive, and
an existing release directory, creating nothing. A static test pins the smoke
to the release pair and the verifier's single mount with --sha256-file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/ci-scripts.test.ts

@@ -164,6 +164,28 @@ describe("CI scripts on a shared Docker daemon", () => {
     expect(deploy).toContain("cp -R /staging/example /modules/.incoming-example");
   });
 
+  it("hand the verifier the package's archive and digest together, from a fresh release pair, never from build output", async () => {
+    const deploy = (await source("scripts/smoke-deploy.sh")).replace(/\\\n\s*/gu, " ");
+    expect(deploy).toContain('source "$repository_root/scripts/lib/module-package-release.sh"');
+    // The pair is made from this run's own build output, into a directory that must not exist yet.
+    expect(deploy).toContain('--output "type=local,dest=${work}/module-package"');
+    expect(deploy).toContain(
+      'package_archive="$(module_package_release "$work/module-package" "$work/package")"',
+    );
+    expect(deploy).toMatch(/^\s*stage package$/mu);
+    // BuildKit's output directory is 0700 and owned by whoever built it: it is never mounted.
+    expect(deploy).not.toContain('"$daemon_work/module-package:');
+    expect(deploy).not.toMatch(/^\s*stage module-package$/mu);
+    // The verifier reads both files from the one mount, and always checks the digest file.
+    const verifier = deploy
+      .split("\n")
+      .find((line) => line.includes("core/dist/cli/verify-module-package.js"));
+    expect(verifier).toContain('-v "$daemon_work/package:/package:ro"');
+    expect(verifier).toContain('"/package/${package_archive}"');
+    expect(verifier).toContain('--sha256-file "/package/${package_archive}.sha256"');
+    expect(verifier).not.toMatch(/--sha256\s/u);
+  });
+
   it("run every deploy smoke against the one generic image, never a second image with a module in it", async () => {
     // ADR 0048: the split topology installs its test module into module storage at run time.
     const deploy = (await source("scripts/smoke-deploy.sh")).replace(/\\\n\s*/gu, " ");