ci: attach the portable archive the updater actually requires

[StaticHumStudio]

Found while preparing v2.0.2. Blocking that release.

The gap

windows-installation-behavior already builds the exact portable zip and its SHA256 sidecar with scripts/build-release.ps1, and runs the tamper-rejection test against those bytes. Then it throws both away. The release job only ever attached the installer .exe, so HumWatch-vX.Y.Z.zip and .zip.sha256 have been uploaded to every release by hand.

That is not a cosmetic omission. scripts/update-core.ps1 resolves both by exact name on the latest release:

if ($zipMatches.Count -ne 1 -or $digestMatches.Count -ne 1) { throw 'The named release or its SHA256 manifest is missing' }

So one forgotten upload does not degrade the updater. It disables it on every portable install pointed at that release, and there is no fallback path. That is a worse failure than the one #12 just fixed, and it was one distracted release away at any time.

The change

• windows-installation-behavior gains a portable_artifact output and uploads the zip plus sidecar (if-no-files-found: error).
• release downloads it into the same staging directory as the installer and attaches all three in one gh release upload, with an explicit check for each.

The attached bytes are now the same ones the tamper test validated, rather than whatever was built by hand on a workstation afterward.

Verification

Workflow parses and the wiring resolves:

behavior outputs: {'portable_artifact': '${{ steps.portable.outputs.name }}'}
release needs: ['build', 'windows-service-security', 'windows-service-security-installed', 'windows-installation-behavior', 'linux-security']
release steps: ['Download validated installer artifact', 'Download validated portable archive', 'Attach to release']

241 passed, 5 skipped. The real proof is the v2.0.2 tag build, which is what this unblocks.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e1c1795e5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject portable archives whose version differs from the target tag

When a manual dispatch supplies a release_tag that differs from the checked-out agent.__version__, this command uploads the build-version archive to the independently selected release—for example, HumWatch-v2.0.1.zip to v2.0.2. The checked gh release upload <tag> <files>... interface accepts arbitrary asset names, while scripts/update-core.ps1 looks only for HumWatch-v2.0.2.zip and its exact sidecar, so the workflow succeeds but leaves portable updating disabled for that release. Validate that the archive version equals $tag.Substring(1) before uploading, or build/name the archive from the target tag.

Useful? React with 👍 / 👎.