release: move publication orchestration into tools/release.zig, pin rotated subkey

.gitea/workflows/gates.yml

@@ -123,57 +123,12 @@ jobs:
 
       # The licence inventory has to cover every package whose bytes ship, and
       # the lockfile does not answer that question: it lists what could be
-      # reached, not what rollup kept. Four packages of the non-dev closure are
-      # recorded as tree-shaken away, and if application code starts importing
-      # one of them, no lockfile, no version and no dependency set changes —
-      # only the bundle does. So the bundle is what this reads.
-      #
-      # A second build with sourcemaps, because the shipped build has none: the
-      # `sources` list of each chunk names the packages whose modules went into
-      # it. The output goes to its own directory so the artifact npm run build
-      # produced is the one that gets embedded, untouched.
+      # reached, not what rollup kept. The bundle is what this reads. The logic
+      # lives in web/scripts/, unit-tested by `npm test`, so it runs on a laptop
+      # exactly as it runs here (milestone-14 deviation 24).
       - name: Assert the packages bundled into web/dist are the recorded ones
         working-directory: web
-        run: |
-          set -euo pipefail
-          # The binary npm ci installed, never `npx`: npx silently downloads a
-          # package it cannot find locally, so a wrong working directory would
-          # turn a licence check into an unpinned fetch from the network.
-          ./node_modules/.bin/vite build --sourcemap --outDir dist-sourcemap --emptyOutDir >/dev/null
-
-          maps=$(find dist-sourcemap -name '*.map' -type f | LC_ALL=C sort)
-          if [ -z "$maps" ]; then
-            echo "the sourcemap build produced no .map files; this check cannot run blind"
-            exit 1
-          fi
-
-          # shellcheck disable=SC2086
-          bundled=$(jq -r '.sources[]' $maps \
-            | grep 'node_modules/' \
-            | sed 's|.*node_modules/||' \
-            | awk -F/ '{ if ($1 ~ /^@/) print $1"/"$2; else print $1 }' \
-            | LC_ALL=C sort -u)
-
-          recorded=$(awk '
-            /^\[npm packages bundled into web\/dist\]$/ { grab = 1; next }
-            grab && /^\[/ { exit }
-            grab && NF { print }
-          ' ../licenses/dependency-identity.txt | LC_ALL=C sort -u)
-
-          if [ -z "$recorded" ]; then
-            echo "licenses/dependency-identity.txt has no '[npm packages bundled into web/dist]' section"
-            exit 1
-          fi
-
-          if ! diff -u <(printf '%s\n' "$recorded") <(printf '%s\n' "$bundled"); then
-            echo
-            echo "the set of npm packages in web/dist has changed (-recorded +current)."
-            echo "Work out what the change means for licenses/inventory.zon first, then record"
-            echo "the new list in that section of licenses/dependency-identity.txt."
-            exit 1
-          fi
-          echo "web/dist bundles exactly the recorded packages:"
-          printf '%s\n' "$bundled"
+        run: npm run assert-bundled
 
   package:
     runs-on: ubuntu-24.04