FIX: Harden cross-platform release validation

[merefield]

Summary

• verify every release matrix job still checks out the immutable commit validated from the tag
• run an explicit native CLI build on Ubuntu, macOS, and Windows before publishing
• wait for a complete numeric fixture-server port in the Windows installer tests

Validation

• go vet ./...
• go test -race ./...
• go build -buildvcs=false -trimpath ./cmd/clai
• bats test (18 tests)
• Windows and macOS amd64 cross-builds

[Copilot]

🟢 Approval recommended

The changes are straightforward hardening improvements and appear correct, with only minor error-message clarity suggestions outstanding.

Pull request overview

This PR hardens the release pipeline by ensuring cross-platform release test jobs run against the same validated commit as the release tag, and by strengthening pre-publish validation (including a native CLI build) while reducing flakiness in Windows installer tests.

Changes:

• Add a post-checkout verification step in the release test matrix to ensure HEAD matches the commit SHA validated from the tag.
• Add an explicit go build -buildvcs=false -trimpath ./cmd/clai step in the release test matrix before publishing.
• Update the Windows installer test harness to wait until the fixture server port file contains a complete numeric port.

File summaries

File	Description
test/install-release.ps1	Improves fixture-server port readiness handling to wait for a fully written numeric port value.
.github/workflows/release.yml	Adds commit immutability verification in the OS matrix and adds an explicit build step prior to publishing.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.