release: cut-release.sh — reproducible release bundle from a clean tree (vms-d73)

[baron-3dl]

Summary

Foundation of the Release Engineering pillar (epic vms-a84). Implements vms-d73.

• tools/cut-release.sh: git-archives the requested commit to a clean /tmp tree (never builds into the repo, per the standing containerized-build rule), drives the existing distro/Dockerfile.bootable build via docker buildx build --output=local, and writes dist/release-<version>/ containing vmlinuz, initramfs-ovmx-slim.cpio.gz, ovmx-distrib.img, ovmx-os.kit, SHA256SUMS, and an OVMX-defined (Rule 8, explicitly labeled) release-manifest.json mapping component → version → sha256, including the OS kit's own internal file listing (asserts DCL.EXE/LOGINOUT.EXE/STARTUP.COM present, from the shipped kit itself).
• Version is single-sourced from the archived src/libvms/include/ovmx_identity.h (OVMX_PRODUCT_NAME/OVMX_PRODUCT_VERSION) — no version literal in the script.
• CMakeLists.txt: optional make release convenience target wrapping the script.

Reproducibility required normalizing every wall-clock timestamp the build stamps into shipped bytes:

• distro/Dockerfile.bootable gains a SOURCE_DATE_EPOCH build-arg (default 0), threaded into every initramfs pack step (file mtimes normalized, cpio member order sorted, gzip -n instead of gzip).
• tools/ovmx_kit_pack.c (kh_build_time) and tools/vmsfs_master.c (fh_created/fh_modified/fh_accessed) now read SOURCE_DATE_EPOCH instead of time(NULL) when set.
• cut-release.sh defaults SOURCE_DATE_EPOCH to the cut commit's own timestamp, so two independent cuts of the same commit are deterministic automatically.

CI (.github/workflows/ci.yml, new cut-release-reproducible job, gated behind a new release path filter):

1. Cuts the same commit twice, each with --no-cache (no shared build cache between them — proves reproducibility, not cache reuse).
2. Diffs all four artifacts + SHA256SUMS byte-for-byte between the two cuts.
3. Recomputes SHA256 against the shipped bytes and compares against release-manifest.json (defense against a bug in the script's own checksum step).
4. Reuses tests/qemu/test_distrib_boot.sh unmodified — bind-mounts the freshly-cut bundle's own vmlinuz/initramfs-ovmx-slim.cpio.gz/ovmx-distrib.img at the paths it expects — to boot the actual cut bundle to a real SYSTEM login prompt, rather than reinventing the boot proof.

Verification so far

• ctest (dev build): 123/124 pass. The 1 failure, env_identity_census_negctl, is a pre-existing, already-tracked dev-host-load timeout (vms-3f9) unrelated to any file this PR touches (it source-scans src/ for env-var census declarations) — reproduced the same timeout in isolation, confirming it's host contention, not a regression.
• shellcheck tools/cut-release.sh: clean.
• actionlint .github/workflows/ci.yml: no new findings (pre-existing warnings only, all outside the new job).
• Dockerfile edits spot-checked by building the link-native stage locally; full Dockerfile parses and the touched builder-stage blocks were reviewed line-by-line for correct &&/\ chaining.
• Manifest JSON generation and the CI job's grep/sed checksum-extraction logic dry-run tested against a synthetic fixture — valid JSON, correct extraction.
• SOURCE_DATE_EPOCH override verified directly against ovmx_kit_pack: two packs with a fixed epoch are byte-identical; a pack without the override differs, confirming the override actually takes effect.

Not yet run: the actual containerized 2×-build-plus-boot proof — that only runs in CI (cut-release-reproducible), which this PR triggers. Two full from-scratch builds (~25–30 min cold each) plus the boot-smoke test make it the heaviest job in the workflow; watching CI now.

Test plan

• ctest baseline (pre-existing flake noted, not caused by this change)
• shellcheck / actionlint clean
• CI cut-release-reproducible job passes (byte-identical artifacts across two independent --no-cache cuts + boot-to-login proof) — watching this before merge

🤖 Generated with Claude Code