FIX: Harden cross-platform release validation

.github/workflows/release.yml

@@ -77,6 +77,17 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ needs.validate.outputs.tag }}
+      - name: Verify validated commit
+        shell: bash
+        env:
+          EXPECTED_COMMIT: ${{ needs.validate.outputs.commit }}
+        run: |
+          actual_commit=$(git rev-parse HEAD)
+          if [[ "$actual_commit" != "$EXPECTED_COMMIT" ]]; then
+            printf 'Release tag changed after validation (expected %s, got %s).\n' \
+              "$EXPECTED_COMMIT" "$actual_commit" >&2
+            exit 1
+          fi
       - uses: actions/setup-go@v7
         with:
           go-version: 1.26.6
@@ -98,6 +109,8 @@ jobs:
         run: go vet ./...
       - name: Test
         run: go test -race ./...
+      - name: Build
+        run: go build -buildvcs=false -trimpath ./cmd/clai
       - name: Test Unix release installer
         if: runner.os == 'Linux'
         run: bats test

test/install-release.ps1

@@ -53,12 +53,15 @@ with open(sys.argv[2], "w", encoding="ascii") as port_file:
 server.serve_forever()
 '@
     $serverProcess = Start-Process -FilePath $python.Source -ArgumentList @($serverScript, $serverRoot, $portFile) -PassThru
-    for ($attempt = 0; $attempt -lt 50 -and -not (Test-Path -LiteralPath $portFile); $attempt++) {
+    $port = ""
+    for ($attempt = 0; $attempt -lt 50; $attempt++) {
         if ($serverProcess.HasExited) { throw "fixture HTTP server exited before reporting its port" }
+        if (Test-Path -LiteralPath $portFile) {
+            $port = ([string](Get-Content -LiteralPath $portFile -Raw)).Trim()
+            if ($port -match '^\d+$') { break }
+        }
         Start-Sleep -Milliseconds 100
     }
-    if (-not (Test-Path -LiteralPath $portFile)) { throw "fixture HTTP server did not report its port" }
-    $port = (Get-Content -LiteralPath $portFile -Raw).Trim()
     if ($port -notmatch '^\d+$') { throw "fixture HTTP server reported an invalid port: $port" }
     $baseUrl = "http://127.0.0.1:$port"
     $webRequestArgs = @{}