fix: keep pnpm's package store out of the release builder's clean-source check

The package-release job failed its clean-tree assertion in CI. Reproduced
as root in a container with a bind-mounted checkout, as the Gitea runner
does: after checkout the tree is clean; `pnpm install --frozen-lockfile`
then creates `.pnpm-store/` (17,272 untracked files) at the checkout's
root, because pnpm keeps its store on the node_modules file system and
the checkout is its own mount; `pnpm build` changes nothing. No tracked
file is ever modified.

- `.pnpm-store/` is ignored, like node_modules: a package cache, never
  source. The clean-commit requirement is unchanged for every tracked
  file and every untracked file Git does not ignore.
- The clean-tree failure now lists `git status --short` and
  `git diff --stat`.
- Nothing is built before the clean-source assertion: the gate no longer
  runs a global `pnpm build` first. The builder asserts a clean tree,
  builds, then fails if its build changed the tree, before packing. Core's
  verifier is built after both releases, for the consumer proof only.
- Every secondary offline install (the second worktree, the consumer
  module) uses the workspace install's own store explicitly, since pnpm
  picks a store per file system and those directories are on another.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/test-package-release.sh

@@ -9,8 +9,11 @@
 # 2. Builds it again from a separate worktree of the same commit, at another absolute path, and
 #    requires the two release directories to be byte-identical: every tarball, SHA256SUMS, and the
 #    manifest.
-# 3. Installs the release into the standalone fixture and proves it builds, packages, and verifies
-#    (`scripts/test-standalone-module.sh`).
+# 3. Builds Core's verifier, then installs the release into the standalone fixture and proves it
+#    builds, packages, and verifies (`scripts/test-standalone-module.sh`).
+#
+# Nothing is built before step 1: the release builder asserts a clean source tree first, builds, and
+# asserts the build changed none of it. Every offline install uses the workspace install's own store.
 #
 # `--allow-modified` is for local development on a modified source tree. The second build is then
 # made in this checkout again, because a worktree of the commit would not hold the modifications.
@@ -25,6 +28,11 @@ elif (($#)); then
   exit 64
 fi
 
+# The workspace install's own pnpm store. pnpm chooses a store per file system, so an install in a
+# temporary directory would otherwise look in another, empty one; every install here is offline.
+store="$(dirname "$(cd "$repository_root" && pnpm store path)")"
+export EKKLESIA_PNPM_STORE="$store"
+
 work="$(mktemp -d "${TMPDIR:-/tmp}/ekklesia-package-release-XXXXXX")"
 worktree="$work/second-checkout"
 cleanup() {
@@ -44,7 +52,7 @@ if ((${#allow_modified[@]})); then
   node "$repository_root/scripts/package-release.ts" --out "$work/second" "${allow_modified[@]}" >/dev/null
 else
   git -C "$repository_root" worktree add --detach --quiet "$worktree" HEAD
-  (cd "$worktree" && pnpm install --offline --frozen-lockfile --reporter=silent)
+  (cd "$worktree" && pnpm install --offline --frozen-lockfile --store-dir "$store" --reporter=silent)
   node "$worktree/scripts/package-release.ts" --out "$work/second" >/dev/null
 fi
 if ! diff -r "$release" "$(find "$work/second" -mindepth 1 -maxdepth 1 -type d)"; then
@@ -53,6 +61,11 @@ if ! diff -r "$release" "$(find "$work/second" -mindepth 1 -maxdepth 1 -type d)"
 fi
 echo "    byte-identical: $(ls "$release" | wc -l) files"
 
+# The consumer proof verifies with Core's own verifier. Built only now, after both releases: the
+# release builder asserts a clean source tree before it builds anything.
+echo "==> Building Core's verifier"
+(cd "$repository_root" && pnpm exec turbo run build --filter=@ekklesia/core --output-logs=errors-only >/dev/null)
+
 echo "==> Consuming the release from a standalone module"
 bash "$repository_root/scripts/test-standalone-module.sh" --release "$release" "${allow_modified[@]}"