release: repair hosted Windows proof and managed runtime

[scottconverse]

Why

The immutable v1.5.1 tag failed its exact Release Gate (run 29987927784, attempt 3): two failures were inherited-environment contamination, while three real plan-generation failures reproduced against shipped Ollama v0.30.9. An exact local A/B at the same model digest/prompt/context was 1/3 on v0.30.9 and 3/3 on v0.32.0.

What changed

• pin the managed Windows Ollama runtime to v0.32.0 with official size/SHA-256 and a version-scoped install root
• promote downloads/extractions only after full verification, preserving an existing runtime on failure
• move the full release proof to a declared windows-2022 GitHub-hosted runner; no self-hosted bootstrap, Windows Sandbox, or reboot dependency
• pin release-critical Actions and toolchain inputs and emit a substrate receipt bound to source, run, image, tool/model identities, and unsigned-installer bytes
• require the signing workflow to validate that receipt before signing and again after public re-download
• fail closed on inherited KIMCAD_INSTALL_ROOT, PYTHONPATH, and nested OLLAMA_HOST contamination
• stage installer plus receipt on one RUNNER_TEMP volume and enforce both hashes plus exactly two files
• add pinned actionlint and mutation-tested release-wiring guards
• mark deterministic credential test fixtures with line-local gitleaks allowances

Test-first evidence

RED:

• exact runtime identity test failed on v0.30.9 vs expected v0.32.0
• five managed-runtime regressions failed before the versioned/staged implementation
• release guard initially reported 24 missing hosted-proof/signing requirements
• cross-volume upload and masked-install mutations failed before their fixes
• second-order mutations proved decorative exit guards and removed staging hashes/count were not initially detected

GREEN at exact branch head:

• 84 focused runtime/release guard tests passed
• 4 credential-redaction tests passed
• Ruff passed on changed Python
• release-wiring guard passed: 16 lanes (5 CI, 11 release-only)
• actionlint v1.7.12 passed all 4 workflows
• 17 explicit PowerShell workflow blocks passed AST parsing
• withdrawn-version docs guard passed
• gitleaks 8.30.1 passed the staged diff
• git diff --check passed
• independent reviews: 0 Blockers, 0 Majors, 0 Minors

Local limitation

The narrow SettingsDialog Jest check did not reach Jest: dependency provisioning failed twice because this machine lacks the Visual Studio C++ workload required by tree-sitter-openscad. Per the retry rule, it was not retried again. Hosted CI is the authoritative UI lane.

Release safety

This PR does not mutate protected tag v1.5.1 or update its public release. Superseding it with v1.5.2 remains an explicit owner decision after exact-head CI and the hosted full-gate rehearsal are green.

[scottconverse]

Hosted full-gate attempt 1: run 30204263782 failed after all substrate provisioning passed, at the model identity comparison.

Exact diagnosis: Ollama v0.32.0 successfully pulled qwen3.5:9b and /api/tags returned digest bytes 6488c96f...93ea7; the reviewed pin is the same bytes in canonical form sha256:6488c96f...93ea7. The comparison rejected only the omitted scheme prefix.

Targeted correction at d99c3e5: normalize prefixed/unprefixed API output to canonical sha256:..., compare that value to the exact pin, and record the same canonical value in the substrate receipt. Test-first RED/GREEN: 1 failing guard mutation -> 15/15; focused suite 85/85; Ruff, wiring, actionlint, 17 PowerShell AST blocks, gitleaks, and independent review (0 Blocker / 0 Major / 0 Minor) are green.

No blind rerun was made. Exact-head CI will run first; only then will hosted full-gate attempt 2 be dispatched.

[scottconverse]

Hosted full-gate attempt 2: run 30205234213 confirmed the digest correction: Ollama v0.32.0 and the exact qwen3.5:9b digest passed, and the complete release proof advanced through the earlier test/build lanes.

The terminal Playwright lane finished 20 passed / 2 failed (14.2m):

1. accessibility-release.spec.ts — release surfaces have serious WCAG color-contrast violations. Representative observed ratios were 1.52:1, 4.11:1, and 2.47:1 against the required 4.5:1.
2. manufacturing-flow.spec.ts — the narrow-screen manufacturing flow never exposed mobile-printer-select within the 30-second assertion window.

This is the second failed hosted gate attempt. Per the repo's two-failure rule, work and reruns stop here for owner review. The PR remains unmerged; no v1.5.2 tag was created; v1.5.1 and its public assets remain untouched; no signing or publication occurred.