fix: keep generated build output out of the worktree

[magetsu002]

Summary

Prevent the V1.1 clean-room workflow from leaving generated read-only build output in the repository worktree.

The build creates both dist/ and dist-readonly/, but only dist/ was ignored. A successful clean-room certification therefore left dist-readonly/ as an untracked directory.

This change ignores dist-readonly/ and adds a clean-room assertion that verifies generated build directories do not appear in Git status after the final rebuild.

Change type

• Bug fix
• Feature
• Security hardening
• Refactor
• Documentation
• Dependency update
• CI / tooling

Motivation

A successful V1.1 clean-room certification should leave the reviewed source checkout clean.

After the full workflow passed, Git reported ?? dist-readonly/.

This showed that the certification harness did not verify build-output hygiene after its final rebuild.

Related issue: None.

Implementation details

• Added dist-readonly/ to .gitignore.
• Preserved the existing build cleanup that removes both dist/ and dist-readonly/.
• Added a final clean-room assertion scoped to dist and dist-readonly.
• The clean-room workflow now fails if either generated build directory appears as tracked, modified, or untracked output after the final rebuild.
• The assertion is limited to generated build paths so intentional source changes on the branch do not cause false failures.

Security impact

Does this change affect any of the following?

• Authorization decisions
• Capability permissions
• Remote execution boundary
• SSH transport behavior
• Key handling or cryptography
• Audit logging
• Rollback behavior
• No security impact

If yes, explain:

No production runtime or security behavior changed.

The change only affects generated build-output handling and clean-room certification checks.

Validation performed

Commands/tests executed:

• npm test
• npm run release:check
• npm run security

Additional validation:

• Ran the complete V1.1 clean-room workflow.
• Clean-room workflow completed successfully in 68 seconds.
• Clean-room process exited with code 0.
• Verified installation, initialization, application registration, remote setup, doctor, boundary verification, exact deployment planning, exact-plan apply, no-change synchronization, partial-state diagnosis, evidence-preserving repair, and final rebuild.
• Verified the final rebuild no longer leaves dist-readonly/ as untracked output.
• git diff --check passed.

Security considerations

Explain:

• What security assumptions changed?

  None.

• What prevents abuse or regression?

  The clean-room harness now explicitly checks that generated build directories do not appear in Git status after the final rebuild.

  This prevents future build-script changes from silently leaving generated runtime artifacts in the reviewed source worktree.

• Were existing protections preserved?

  Yes. Authorization, capability enforcement, SSH host verification, remote execution confinement, signed state, audit integrity, deployment rollback, and recovery behavior remain unchanged.

Compatibility

Does this change affect:

• Existing configurations
• Existing installations
• CLI commands
• MCP protocol behavior
• No compatibility impact

Documentation

• Documentation updated
• Operator workflow updated if needed
• No documentation changes required

Final checklist

• Tests pass
• Security checks pass
• No secrets or private keys included
• No security controls weakened
• Backward compatibility considered
• Ready for review