fix: exercise strict release checks in CI

tests/release-safety.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
 import {
   BASELINE_RELEASE_CAPABILITIES,
   capabilityEnabled,
@@ -36,7 +37,7 @@ describe('deployment rollout gate', () => {
       mode: 'demo', releaseId: 'local', releaseEnvironment: 'production', dashboardImage: 'convex-dashboard:latest',
       convexImage: 'convex-backend:latest', dockerfile: 'FROM oven/bun:latest',
       capabilityAllowlist: 'wallet_balance,unknown', trackedFiles: ['.env.example', 'secrets/app.pem'],
-      browserBundleFiles: ['build/client/app.js'],
+      browserBundleFiles: ['build/client/app.js'], browserBundlePresent: false,
     });
     expect(errors).toEqual(expect.arrayContaining([
       'APP_RELEASE_ID must be a non-placeholder immutable identifier for this release environment',
@@ -47,6 +48,18 @@ describe('deployment rollout gate', () => {
       'Unknown deployment capability: unknown',
       'secret-like file is tracked: secrets/app.pem',
       'browser client artifacts contain managed secret names',
+      'built browser client artifacts are required for staging/production release checks',
     ]));
   });
+
+  test('the repository Dockerfile passes strict base-image validation', () => {
+    const errors = releaseSafetyErrors({
+      mode: 'live', releaseId: 'ci-abc1234', releaseEnvironment: 'production',
+      dashboardImage: 'ghcr.io/get-convex/convex-dashboard@sha256:' + 'a'.repeat(64),
+      convexImage: 'ghcr.io/get-convex/convex-backend@sha256:' + 'b'.repeat(64),
+      dockerfile: readFileSync('Dockerfile', 'utf8'), capabilityAllowlist: undefined,
+      trackedFiles: [], browserBundlePresent: true,
+    });
+    expect(errors).toEqual([]);
+  });
 });