[HackTuah]

Closes the follow-up slice 062 left: the gate never compiled :prod, so a defect that only exists
in a release could not surface until a tag was pushed, which is after approval.

What was measured before choosing

	cold	warm	catches the 062 defect?	runs when
MIX_ENV=prod mix compile	52 s	~2 s	yes, exit 1 on the first command	every push
+ mix release headless	+1.4 s	+1.4 s	— adds the release's application list and boot scripts	every push
+ bin/headless eval	+0.3 s	+0.3 s	— adds runtime.exs's prod branch, 116 lines nothing else executes	every push
package on branches	~16 min	—	only by luck	when a packaging input changes

The last row is the reason the gate step is the primary fix rather than the packaging trigger.
package.yml's path filter is mix.exs, mix.lock, config/**, src-tauri/**,
rust-toolchain.toml, .tool-versions — it does not match lib/. Slice 062's defect was in
lib/trinity/mcp/server/plug.ex; the fix commit for it touched no filtered path at all. A
branches trigger would have caught the slice only because it happened to add jose to mix.exs
in the same slice. A pure code change with the same defect would still reach the tag unseen.

CI minutes are not the constraint here (the repository is public, so GitHub-hosted runners are
free); wall clock and flake surface are, which is why the 16-minute three-OS build stays on the
inputs that actually govern it.

What this changes

1. scripts/prod_check.sh, run by mix gate as cmd ./scripts/prod_check.sh, the same way
   plan_check.sh is: its own process, its own exit code. Three commands, each for a class the one
   before it cannot see — prod compile, release assembly, runtime-config evaluation. Demonstrated
   red against slice 062's original closure and green after it.
2. package.yml gains branches: ['**'] beside its tags, same path filter. A dependency, a
   toolchain pin or a Tauri change is now packaged on the branch that makes it instead of at the
   tag. This is the class the gate step cannot reach: a NIF that will not load under Burrito's musl
   ERTS (slice 013's mdex finding) needs a real bundle, not a compile.
3. CLAUDE.md's Definition of Done names the release check; ROADMAP.md carries the change-log
   line with the measurements.

What it still does not prove

Nothing here builds a Burrito binary, loads a NIF under musl, builds the Tauri shell, or runs on
macOS or Windows. That remains package's job, on tags, on packaging-input pushes, and on demand.