Reject stale native runtime build provenance before release staging

tools/embeddinggemma2/runtime_provenance.py

@@ -0,0 +1,34 @@
+"""Build-input identity for detecting stale, otherwise checksum-valid runtimes."""
+import hashlib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+UPSTREAM_COMMIT = "4d756bc72bf00a4aacf410ae15a2d315f3db400d"
+INPUTS = (
+    "crates/searchi-semantic/native/worker.cpp",
+    "crates/searchi-semantic/native/CMakeLists.txt",
+    "tools/embeddinggemma2/build_runtime.py",
+    "tools/embeddinggemma2/no-logits.patch",
+    "tools/embeddinggemma2/cpu-dispatch.patch",
+    "tools/embeddinggemma2/cpu-only-loader.patch",
+)
+
+
+def fingerprint(root=ROOT):
+    hashes = {}
+    for name in INPUTS:
+        path = Path(root) / name
+        with path.open("rb") as source:
+            data = source.read(1024 * 1024 + 1)
+        if not data or len(data) > 1024 * 1024:
+            raise ValueError("Native build input is empty or oversized")
+        # Only build-source line endings are canonicalized; indexed user bytes
+        # and extraction provenance are never processed by this helper.
+        hashes[name] = hashlib.sha256(data.replace(b"\r\n", b"\n")).hexdigest()
+    return {"schema": 1, "upstream_commit": UPSTREAM_COMMIT,
+            "normalization": "CRLF-to-LF build inputs only", "inputs": hashes}
+
+
+def verify(manifest, root=ROOT):
+    if not isinstance(manifest.get("build_provenance"), dict) or manifest["build_provenance"] != fingerprint(root):
+        raise ValueError("Runtime build provenance missing or stale; rebuild the normal native runtime")