fix(assets): select release archives by client version

[blakinio]

Purpose

Prevent unrelated legacy or macOS archives from being selected by the client-assets GitHub release resolver while preserving strict hashes, standard install paths and codeload fallback.

Task

• Task: OTC-20260726-client-assets-release-selection
• Stable clean base: e9bcc172f005fb9993178b17f630acf382656090
• Current head: e02ef6bfb806639dfb003b2dc5913327cddf2594
• Latest backup: backup/OTC-20260726-client-assets-release-selection-pre-20260729-restack-7
• Earlier backup branches retain all superseded and previously verified heads.
• Reviewed upstream clue: 465b7a217e87502bb7f9980bf6e099718d0a9a49

Scope

• cache-stable per-release archive scoring/preparation
• exclusion of macOS and unrelated legacy archives
• forced existing codeload fallback when no matching archive exists
• synthetic release fixtures
• final things/sounds/extras and runtime-file path contracts
• only the focused test is registered; the shared Lua suite retains LABELS "lua;unit"

Verified behavior

• only the configured GitHub releases repository/path is adapted
• other repositories, paths, errors and non-table HTTP JSON responses pass through unchanged
• macOS and unrelated legacy archives are removed before the existing resolver
• absence of a matching archive preserves the established codeload fallback
• existing strict hashes, extraction and final installation paths remain authoritative

Verified diff

Exactly nine files. No historical stack or unrelated files are included. W4 plan, Windows application shell, closure and all W4 lifecycle archives through #82 are retained from main; only the changelog overlapped and was reconciled.

Safety and blocker

• no game/archive bytes or proprietary assets
• no authentication, protocol, renderer, Canary or server changes
• production runtime archive compatibility remains blocked on a real-release rehearsal using a clean writable directory, the actual configured release, strict hash/integrity verification and fresh exact-client startup
• synthetic fixtures and compiled CI do not satisfy that rehearsal

Validation

Head a26efb7af14afe39e310cb393b130d4270fc1673 passed exact-head run 30438208569, including all five Windows jobs, CMake Tests/CTest and CI / Required job 90547397445, but W4 advanced main before merge.

Head 94061a65d3e1d0961c9c95022c18da484788ab99 started run 30443793680; Fast/Lua/luacheck/cppcheck were green and the Windows matrix was active when W4 implementation/lifecycle advanced main.

A final exact-head run for e02ef6bfb806639dfb003b2dc5913327cddf2594 must pass Lua Syntax, Windows CMake Tests/CTest, the full required Windows matrix and CI / Required before squash merge.

[blakinio]

Coordinator preflight against current main c26e2df6888b70c7120760c88bcff4f3fcc0ac97 shows this head (b04c6d3dc69797268f03af9823db4a7c99e0ee38) is diverged: 1 commit ahead and 3 commits behind. The in-progress CI run on the current head cannot be final merge evidence. Before readiness, restack the exact nine-file package onto current main, preserve the documented real-release rehearsal blocker, update the task/PR evidence, and rerun the complete exact-head required checks. No W2 Rust workspace, diagnostics-contract, or shared-path lease overlap was found.