Reject stale native runtime build provenance before release staging

tools/package_windows.py

@@ -13,6 +13,7 @@ import struct
 import stat
 import tempfile
 import zipfile
+from embeddinggemma2.runtime_provenance import verify as verify_provenance
 
 ROOT = Path(__file__).resolve().parents[1]
 CRT_LIBRARIES = {"concrt140.dll", "msvcp140.dll", "msvcp140_1.dll", "msvcp140_2.dll", "msvcp140_atomic_wait.dll", "msvcp140_codecvt_ids.dll", "vccorlib140.dll", "vcruntime140.dll", "vcruntime140_1.dll", "vcruntime140_threads.dll"}
@@ -114,6 +115,7 @@ def package(root, executable, output, cli=None):
     manifest = json.loads(inventory_bytes)
     if not isinstance(manifest, dict):
         raise ValueError("Invalid runtime dependency inventory")
+    verify_provenance(manifest, root)
     libraries = manifest.get("libraries")
     if not isinstance(libraries, list) or not 1 <= len(libraries) <= 64:
         raise ValueError("Invalid runtime dependency inventory")