fix(release): carry the incubator disclaimer in CLI ZIPs

Generated-by: Codex

Author: Astro-Han

.github/RELEASE_CHECKLIST.md

@@ -41,7 +41,7 @@ must never be exposed to fork or ordinary pull-request jobs.
    - `Maka-<version>-cli-mac-arm64.zip` and checksum;
    - `Maka-<version>-bundled-git-source.tar.gz` and checksum;
    - the platform update metadata and Desktop ZIPs produced by electron-builder.
-6. Inspect the CLI ZIP. It must contain `bin/maka`, `RELEASE.json`, `LICENSE`, `NOTICE`,
+6. Inspect the CLI ZIP. It must contain `bin/maka`, `RELEASE.json`, `DISCLAIMER-WIP`, `LICENSE`, `NOTICE`,
    `THIRD_PARTY_NOTICES.txt`, the pinned Node license, and no `bin/maka-agent`.
 7. Confirm `RELEASE.json` records the Draft's product version and source SHA, the official Node
    URL/archive/digest, npm version, workspace and production dependency closures, dependency

docs/cli-distribution.md

@@ -39,7 +39,8 @@ The TUI is the default interactive mode of `maka`, not a separate artifact.
 | `signing` | `developer-id-notarized` for release artifacts; `development` for local checks |
 
 The CLI-specific `THIRD_PARTY_NOTICES.txt` must enumerate exactly the external production
-dependencies recorded in `RELEASE.json`. The archive checksum is generated only after signing and
+dependencies recorded in `RELEASE.json`. The archive also carries the repository's
+`DISCLAIMER-WIP`, `LICENSE`, and `NOTICE`. The archive checksum is generated only after signing and
 notarization complete.
 
 Every Mach-O file inside the archive is signed and the ZIP is submitted to Apple's notary service.

scripts/package-macos-arm64-cli.mjs

@@ -735,6 +735,7 @@ export async function packageMacosArm64Cli({
 
   const version = identity.version;
   await Promise.all([
+    access(join(repoRoot, 'DISCLAIMER-WIP')),
     access(join(repoRoot, 'LICENSE')),
     access(join(repoRoot, 'NOTICE')),
     ...workspacePackages.map(({ directory }) => access(join(directory, 'dist'))),
@@ -788,6 +789,7 @@ export async function packageMacosArm64Cli({
     await Promise.all([
       copyFile(officialNode.execPath, join(embeddedNodeDirectory, 'bin', 'node')),
       copyFile(officialNode.licensePath, join(embeddedNodeDirectory, 'LICENSE')),
+      copyFile(join(repoRoot, 'DISCLAIMER-WIP'), join(archiveRoot, 'DISCLAIMER-WIP')),
       copyFile(join(repoRoot, 'LICENSE'), join(archiveRoot, 'LICENSE')),
       copyFile(join(repoRoot, 'NOTICE'), join(archiveRoot, 'NOTICE')),
       writeFile(join(binDirectory, 'maka'), macosArm64CliWrapper(), 'utf8'),

scripts/verify-macos-arm64-cli.mjs

@@ -532,6 +532,7 @@ export async function verifyMacosArm64Cli(
       makaPath,
       metadataPath,
       thirdPartyNoticesPath,
+      join(archiveRoot, 'DISCLAIMER-WIP'),
       join(archiveRoot, 'LICENSE'),
       join(archiveRoot, 'NOTICE'),
       join(archiveRoot, 'libexec', 'node', 'LICENSE'),