Build deterministic Pylon Prime release artifacts #28

Problem

The Pylon fork has no reproducible or provenance-bearing release artifact. scripts/pack-prime-agent-release.mjs can build npm-compatible tarballs and checksums, but no protected pylon workflow invokes it. Its current output retains upstream repository identity, runs through build paths that may refresh live model catalogs, and has no fork build identity, integrity-locked internal dependency graph, double-build proof, or signed provenance.

Pylon therefore cannot offer a truthful fork install/update path or supply exact stock/fork artifacts to its bridge CI.

Required artifact contract

Keep runtime compatibility:

• installed package name: prime-agent;
• command: prime-agent;
• public root SDK and frozen feature negotiation remain the behavioral gate.

Give release assets distinct Pylon identity:

• pylon-prime-agent[-ai|-core|-tui]-<npmVersion>.tgz;
• immutable pylon-prime-agent-release-v1.json with source repository/commit/tree, build id, recipe revision, channel-neutral package assets, sizes, SHA-256/SHA-512, minimum Node, and attestation subjects;
• package metadata pylonDistribution containing only immutable build provenance fields, plus the fork repository URL;
• exact internal tarball URLs and npm-shrinkwrap.json integrity entries tied to the immutable build release.

Neither versions, tags, manifests, nor package metadata enable daemon features. Pylon must continue to require the exact SDK token and post-attach negotiated proof.

Reproducibility requirements

• Add an offline release build that consumes committed generated model data and never refreshes live provider catalogs.
• Pin Node, npm, lockfile, source tree, recipe, and archive URL inputs.
• Pack twice in isolated clean Ubuntu jobs and require every tarball digest to match.
• Reject mutable/missing internal URLs, mismatched package/bin identity, source-tree drift, and non-deterministic output.
• Guard the fork artifact's self-update command so it directs users to the Pylon host instead of switching back to the official R2 feed. Stock Prime keeps its current updater.

Acceptance coverage

• exact asset and manifest schema/names;
• fork repository and build metadata rewrite;
• workspace dependency URL plus shrinkwrap integrity validation;
• clean double-pack byte equality;
• offline build proves no live model request;
• temporary-prefix install imports the public SDK and runs prime-agent --version on Ubuntu, macOS, and Windows;
• POSIX daemon smoke proves frozen root features and exact attach negotiation;
• Windows ACP smoke remains explicit.

Scope and dependencies

This issue owns the deterministic artifact recipe, packer, tests, self-update guard, and artifact documentation only. It grants no publication permission and creates no GitHub release. Publishing/attestation is a separate follow-up.

Coordinate with #1 and Pylon #114. Base release work on the merged pylon branch after #21 / PR #19. Comet and #20 are not dependencies.