Validate stable driver publication before upload

[frahlg]

Summary

• build the full signed candidate under runner temporary storage
• verify candidate signature, payload file, file set and every current artifact before any GitHub write
• require the exact signed beta commit and compare current entries, host API, metadata, sizes, hashes and artifact bytes
• compare the old stable delta while allowing only channel URLs, signatures and channel-local history to differ
• keep release creation, uploads and stable tag movement after the stable gate

Closes #12.

Tests

• make check: 2592 passed, 490 skipped
• focused repository and workflow tests: 18 passed
• read-only replay against current signed beta and stable assets: 62 drivers at 2939543

Coordination

GoodWe #13 has no direct file overlap. This branch does not change drivers, catalog data, channel refs or release assets, and it does not alter the #13 branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3cde1720aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle first stable promotions without a previous manifest

For a stable run where drivers-stable has not been created yet, the earlier history download step leaves FTW_DRIVER_PREVIOUS_MANIFEST unset, so this test -n exits before the later Create channel release when missing step can create the stable release. That makes the first stable promotion of a beta-tested commit impossible even though the workflow still has a missing-release path; allow an empty previous-stable baseline or move creation/bootstrapping ahead of this gate.

Useful? React with 👍 / 👎.