cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17

The first 0.0.17 cut (run 687) failed verify-pins in CI for two reasons. The asset generator embedded admin/dist/.src-hash, a freshness stamp that CI's artifact copy does not carry; it now skips dotfiles. And the Arch zig package emits different code than the ziglang.org tarball that CI installs, so the cut downloads the pinned tarball (ZIG_TARBALL_SHA256 in gates.yml, the full digest keys the cache) and builds the release with it. flake.nix is re-pinned to the bytes both now produce.

The saturated-primary pool test gates its holders on a semaphore instead of sleeps and releases every spawned holder on the way out, so a loaded runner cannot flake it. The package job uploads the payload before the pin check and runs the check when the version or flake.nix changed against the parent. The verify-a-release recipe clones the tag first and builds with the official zig.

build.zig

@@ -334,6 +334,18 @@ pub fn build(b: *std.Build) void {
     });
     test_step.dependOn(&b.addRunArtifact(dist_stage_tests).step);
 
+    // `gen_admin_assets` decides which files reach the binary, and that set must
+    // not depend on the bundle's provenance, so it is tested here too.
+    const gen_admin_assets_tests = b.addTest(.{
+        .name = "gen-admin-assets-tool",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("tools/gen_admin_assets.zig"),
+            .target = b.graph.host,
+            .optimize = optimize,
+        }),
+    });
+    test_step.dependOn(&b.addRunArtifact(gen_admin_assets_tests).step);
+
     addDist(b, options, admin_assets, .{
         .version = version_option,
         .version_string = version_string,