Довёл fix20: firewall-mode, staged state, diagnostics, readiness и build-gate

tools/build/lib/verify.sh

@@ -17,6 +17,23 @@ require_repo_layout() {
   [ -f "apps/frontend/pnpm-lock.yaml" ] || fail "missing apps/frontend/pnpm-lock.yaml"
 }
 
+verify_source_tree_policy() {
+  local allow_dirty="${ALLOW_DIRTY_BUILD:-false}"
+  local dirty="false"
+
+  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    fail "build must run inside git work tree"
+  fi
+
+  if [ -n "$(git status --porcelain 2>/dev/null || true)" ]; then
+    dirty="true"
+  fi
+
+  if [ "$dirty" = "true" ] && [ "$allow_dirty" != "true" ]; then
+    fail "dirty git tree is not allowed for production build; set ALLOW_DIRTY_BUILD=true to override"
+  fi
+}
+
 verify_archive() {
   local version="$1"
   local archive="dist/hy2xs-install-${version}.tar.gz"
@@ -47,5 +64,18 @@ verify_archive() {
   [ -x "$tmp/hy2xs-install/install.sh" ] || fail "install.sh is not executable"
   [ -x "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" ] || fail "orchestrator is not executable"
   [ -x "$tmp/hy2xs-install/ui/hy2xs-admin/hy2xs-admin" ] || fail "hy2xs-admin is not executable"
+
+  "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" status --package-dir "$tmp/hy2xs-install" >/dev/null 2>&1 || true
+
+  local meta
+  meta="$(cat "$tmp/hy2xs-install/metadata/package.env")"
+  printf '%s\n' "$meta" | grep -q '^source_git_commit=' || fail "metadata missing source_git_commit"
+  printf '%s\n' "$meta" | grep -q '^dirty_tree=' || fail "metadata missing dirty_tree"
+  printf '%s\n' "$meta" | grep -q '^build_profile=production$' || fail "metadata missing build_profile=production"
+
+  if declare -F run_fix20_acceptance_subset >/dev/null 2>&1; then
+    run_fix20_acceptance_subset "$tmp/hy2xs-install"
+  fi
+
   rm -rf "$tmp"
 }