fix(workflow): isolate Debian package outputs from cache state

[donbeave]

Root cause

Preview arm64 packaging receives stale cache-restored Cargo workspace outputs. In run 35791295272, target/debian contained the old f7bc191 amd64 package beside the current 507e722 arm64 package. The collector intentionally reads only target/debian and exact target/$TARGET/debian, then fails closed on distinct names.

Fix

• Generator reset now derives exact canonical=target/debian and target_root=target/$TARGET; no target/*/debian traversal.
• Validate TARGET as one safe path component.
• Reject symlink or non-directory components for target, canonical, exact target root/debian, and dist before deletion.
• Use find -P only at the three exact output roots, depth 1, deleting only regular-file or symlink .deb/.deb.sha256 entries.
• Emit the fix from both generator schemas and regenerate preview/release workflows.
• Keep collector fail-closed behavior and add rendered-shell simulations for unrelated-target preservation, final symlink cleanup without following targets, and all intermediate/root symlink refusal.

Verification

Local:

• cargo fmt --all -- --check
• cargo test --locked -p velnor-workflow rendered_debian_reset: 4 passed
• cargo test --locked -p velnor-workflow debian_collect: 4 passed
• cargo test --locked -p velnor-workflow: 2737 passed
• Pinned-generator --plain --check --pin-build: running locally

Normal merge ancestry:

• current main second parent: 6391a0ce53b7e666d1bfb391083011622158f4f3
• PR head: d5deb952676b4f22792a36b5fc89f29a068ee9cc

Do not merge automatically.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.