fix(release): reject mislabeled binary artifacts before install - #1156

Summary

• Embed a versioned { product, version, target } identity in every compiled CLI.
• Make the npm launcher verify that identity after extraction and before it replaces the cached binary.
• Bound the identity process by time and output size, classify failures, clean staging files, and report validation telemetry.
• Keep the identity path independent of the UI, tree-sitter, authentication, and network initialization.
• Assert the compiled Freebuff identity in public CI.

Why

Issues #932, #1082, and #1143 report official platform archives launching unrelated bundled scripts instead of Freebuff. The public build script names a fixed entrypoint, while the launcher previously trusted any executable found under the expected archive filename.

This adds an end-to-end invariant at the consumer boundary: an artifact labeled freebuff-<target> is installable only when the executable identifies itself as the requested Freebuff version and target. A bad update cannot replace a working cached binary.

This is deliberately a defense against release/artifact mix-ups; it does not claim a root cause inside the private release service.

Validation

• bun test cli/src/__tests__/build-identity.test.ts cli/src/__tests__/release/artifact-identity.test.ts cli/src/__tests__/release/wrapper-safety.test.ts — 31 pass
• bun run build:sdk && bun freebuff/cli/build.ts 0.0.0-ci
• Compiled binary reports the exact expected identity from an otherwise empty environment
• bun cli/scripts/smoke-binary.ts cli/bin/freebuff — tree-sitter initialized and the login prompt was detected during the 10-second boot smoke
• Adversarial coverage: wrong product, version, target, schema, unrelated script, missing executable, malformed JSON, oversized output, timeout
• Integration coverage: a local release server serves a mislabeled tarball; the cached binary and metadata remain unchanged
• node --check cli/release-core/launcher.js
• bunx prettier --check on all changed source, test, and workflow files
• Public CI workflow parses as valid YAML

Scope

No backend, production probing, release-host mutation, or checksum/security claim. The contract detects accidental or stale artifact substitution; it is not intended as a cryptographic authenticity mechanism.

Rollout note: publish every target archive built with this identity contract before, or atomically with, the launcher version that enforces it. An older archive without --print-build-info will be rejected and a working cached binary will be retained.

Addresses the failure class reported in #932, #1082, and #1143.