Prepare generated artifacts before staged CI verification

[ranade-oss]

Summary

Prevent staged upstream adaptations from failing verification merely because deterministic governed outputs have not yet been regenerated.

Changes

• detect intentional staged changes only inside GitHub Actions;
• run the four fixed deterministic builders for public content, Ontario workflows, the completion dossier, and the release manifest;
• stage only six explicit generated outputs;
• retain strict npm run check, container preflight, deterministic patch boundaries, and clean-tree verification;
• add an executable Git sandbox test proving generated outputs are refreshed, staged, and leave no unstaged residue.

Cause addressed

Run 30430104685 successfully applied and installed a bounded high-risk authorization adaptation, then failed because reports/release-manifest-v1.json still described the pre-adaptation bytes.

Safety

This behavior activates only when GitHub Actions has intentional staged changes. Ordinary pull-request Baseline checkouts have no staged changes and therefore remain strict read-only verification. Generator commands and output paths are fixed and allowlisted; arbitrary generated files are not staged.