build(plugin): bundle verified native runtime artifacts

[kmbroai]

Summary

Include verified native OS primitives in the standalone plugin and npm package so TypeScript helpers can run without compiling or downloading native code at runtime.

Changes

• Assemble all eight Linux, macOS, and Windows payloads once in PR Node CI and share the artifact with reusable container and test-quality jobs. Standalone and tag-release runs assemble their own artifact.
• Preserve required Node check names and release permissions. Serialize container releases with one concurrency group and retain the repository authorization guard. Remove the unused native download from the MCP test job.
• Copy the complete native tree and dependency notices from the single inventory in plugin-files.json. Missing declared inputs fail the build; undeclared files are excluded.
• Check installed native loading with an empty PATH and link artifact preparation before both README source-build recipes.
• Use asynchronous subprocesses in two runner tests while preserving their assertions and deadlines.

Testing

• Workflow actionlint and formatting passed.
• Independent reviews exercised 49 focused package/workflow tests and nine source-contract tests. An isolated MCP build matched the manifest inventory and loaded its Linux native payload with an empty PATH.
• Prior source-build recipe and installed-package smoke results remain recorded in the PR history; hosted CI validates the refreshed universal artifact and downstream platform jobs.

Risk and rollout

Stacked on #796. Adds about 3.8 MB of native binaries and notices before compression. Source builds require the documented prebuilt inputs. Hosted CI covers universal artifact assembly and downstream platform jobs. Product helpers switch to TypeScript in subsequent changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-08T22:02:11.970508Z	ba3cae4	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Re-reviewed the exact current head after the stacked fixes. The packaged-artifact behavior looks sound and the earlier manifest/docs comments are resolved. I found three concrete CI/test simplifications below.

[mldangelo-oai]

Re-reviewed exact head 2aeff7a. The release workflow now uses one publication concurrency group and the repository-only authorization guard, removing the dead pull-request branches. All prior threads are resolved, the stack base is exact, and all required checks pass.