fix: exercise strict release checks in CI

scripts/release-check.ts

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { parseCapabilityAllowlist, releaseIdIsImmutable } from '../src/lib/server/release-gate';
 
 const RELEASE_ENVIRONMENTS = new Set(['fixture', 'development', 'staging', 'production']);
@@ -15,6 +15,7 @@ type ReleaseCheckInput = {
   capabilityAllowlist: string | undefined;
   trackedFiles: readonly string[];
   browserBundleFiles?: readonly string[];
+  browserBundlePresent?: boolean;
 };
 
 export function releaseSafetyErrors(input: ReleaseCheckInput): string[] {
@@ -35,6 +36,9 @@ export function releaseSafetyErrors(input: ReleaseCheckInput): string[] {
   if (strictEnvironment && !DIGEST_IMAGE.test(input.convexImage)) {
     errors.push('CONVEX_IMAGE must be digest-pinned for staging/production');
   }
+  if (strictEnvironment && input.browserBundlePresent === false) {
+    errors.push('built browser client artifacts are required for staging/production release checks');
+  }
   if (strictEnvironment) {
     const baseImages = [...input.dockerfile.matchAll(/^FROM\s+([^\s]+)(?:\s+AS\s+[^\s]+)?$/gim)].map((match) => match[1]);
     if (baseImages.length === 0 || baseImages.some((image) => !DIGEST_IMAGE.test(image))) {
@@ -45,7 +49,7 @@ export function releaseSafetyErrors(input: ReleaseCheckInput): string[] {
     errors.push('APP_MODE=demo is not permitted for a staging/production release');
   }
   for (const file of input.trackedFiles) {
-    if (/(^|\/)(?:\.env(?:\.|$)|.*\.pem$|.*\.key$)/i.test(file) && file !== '.env.example') {
+    if (/(^|\/)(?:\.env(?:\.|$)|.*\.(?:pem|key|p12|pfx)$|(?:credentials|secrets)(?:\.(?:json|ya?ml|env|txt)|$)|\.npmrc$)/i.test(file) && file !== '.env.example') {
       errors.push(`secret-like file is tracked: ${file}`);
     }
   }
@@ -91,6 +95,7 @@ if (import.meta.main) {
     capabilityAllowlist: process.env.APP_CAPABILITY_ALLOWLIST,
     trackedFiles: trackedFiles(),
     browserBundleFiles: browserBundleFiles(),
+    browserBundlePresent: existsSync('build/client'),
   });
   if (errors.length) {
     console.error(`Release safety check failed (${errors.length} issue${errors.length === 1 ? '' : 's'})`);