feat: the public @ekklesia package release train, built, reproduced, and proven (ADR 0053)

Produces the exact public package tarballs of a platform release, validates
them, and proves a standalone module consumes those artifacts end to end.
Nothing is published and no credential is configured.

- scripts/package-release.ts (pnpm packages:release) is the canonical
  release builder: from a clean commit it rebuilds the nine public
  packages from clean output, packs each, inspects every tarball, checks
  the release set and coordinated versions, and only then writes
  ekklesia-packages-<version>/ with the tarballs, SHA256SUMS, and a
  provider-neutral manifest (ekklesia-package-train.json: version,
  revision, and each package's file, size, SHA-256, npm integrity).
- Packing uses a pack-only pnpm beforePacking hook (passed with
  --config.pnpmfile, never the workspace's install settings). pnpm inserts
  rewritten workspace: dependencies in async completion order, so two
  checkouts of one commit packed module-pack's package.json with keys in a
  different order; the hook restores the source key order (and the
  inspection enforces it). It also drops devDependencies, which named
  private packages outside the train.
- scripts/test-package-release.sh (pnpm test:package-release, the CI
  package-release gate) builds the train twice, the second time from a
  separate worktree, requires byte-identical release directories, then
  runs the standalone consumer proof on the release: manifest checked,
  offline install from the tarballs only, lockfile integrity equal to the
  manifest's, frozen-lockfile reinstall, no Drizzle, one React, contracts
  only transitive, every @ekklesia package and module-pack at the release
  version, skipLibCheck: false, UI build, pack, and Core verification.
- docs/development/releases.md documents the release order, the train,
  the artifacts, and the reproducibility findings; registry publication
  remains unimplemented.
- ADR 0053 is Accepted: everything it decides that does not need a
  registry is now proven, and registry provisioning is on its own
  Deferred list.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/test-package-release.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# The package release gate (ADR 0053): what must pass before a future step may publish a package
+# train. It publishes nothing.
+#
+#   bash scripts/test-package-release.sh [--allow-modified]
+#
+# 1. Builds the public package train from this checkout (`scripts/package-release.ts`): clean build
+#    output, pack, inspect, release manifest.
+# 2. Builds it again from a separate worktree of the same commit, at another absolute path, and
+#    requires the two release directories to be byte-identical: every tarball, SHA256SUMS, and the
+#    manifest.
+# 3. Installs the release into the standalone fixture and proves it builds, packages, and verifies
+#    (`scripts/test-standalone-module.sh`).
+#
+# `--allow-modified` is for local development on a modified source tree. The second build is then
+# made in this checkout again, because a worktree of the commit would not hold the modifications.
+set -euo pipefail
+
+repository_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+allow_modified=()
+if [[ "${1:-}" == "--allow-modified" ]]; then
+  allow_modified=(--allow-modified)
+elif (($#)); then
+  echo "usage: test-package-release.sh [--allow-modified]" >&2
+  exit 64
+fi
+
+work="$(mktemp -d "${TMPDIR:-/tmp}/ekklesia-package-release-XXXXXX")"
+worktree="$work/second-checkout"
+cleanup() {
+  if [[ -d "$worktree" ]]; then
+    git -C "$repository_root" worktree remove --force "$worktree" >/dev/null 2>&1 || true
+  fi
+  rm -rf "$work"
+}
+trap cleanup EXIT
+
+echo "==> Building the package train"
+node "$repository_root/scripts/package-release.ts" --out "$work/first" "${allow_modified[@]}"
+release="$(find "$work/first" -mindepth 1 -maxdepth 1 -type d)"
+
+echo "==> Building it again, to prove the artifacts are reproducible"
+if ((${#allow_modified[@]})); then
+  node "$repository_root/scripts/package-release.ts" --out "$work/second" "${allow_modified[@]}" >/dev/null
+else
+  git -C "$repository_root" worktree add --detach --quiet "$worktree" HEAD
+  (cd "$worktree" && pnpm install --offline --frozen-lockfile --reporter=silent)
+  node "$worktree/scripts/package-release.ts" --out "$work/second" >/dev/null
+fi
+if ! diff -r "$release" "$(find "$work/second" -mindepth 1 -maxdepth 1 -type d)"; then
+  echo "package release gate failed: two builds of the same commit produced different artifacts" >&2
+  exit 1
+fi
+echo "    byte-identical: $(ls "$release" | wc -l) files"
+
+echo "==> Consuming the release from a standalone module"
+bash "$repository_root/scripts/test-standalone-module.sh" --release "$release" "${allow_modified[@]}"
+
+echo "Package release gate passed."