- package.json: add "build:release" script that cleans .build/ + dist/,
passes OMNIROUTE_BUILD_SHA env through the build, runs build + build:cli,
then writes the HEAD sentinel
- scripts/build/write-build-sha.mjs: writes dist/BUILD_SHA and
.build/next/standalone/BUILD_SHA; exits 1 if standalone dir is missing
(guards against stale-cache shipping)
- scripts/build/pack-artifact-policy.ts: allow "BUILD_SHA" in staging exact paths
and add it to the allowed set
Smoke: npm run build:release completes successfully; cat dist/BUILD_SHA ==
git rev-parse --short HEAD (BUILD_SHA_MATCH_OK)
