CI candidate: compile observer and validate-only spike

[mark-e-deyoung]

Public CI/review candidate for the bounded OXCE 8.6.5 compile-observer and validate-only work.

Scope is intentionally narrow:

• passive compile observer contract
• one outer Game::loadMods() phase hook
• environment-gated validate-and-exit path
• bounded item/research final identity + existing OXCE creator/last-updater provenance in validate-only mode
• observer smoke tests
• public Linux + Windows full-engine build workflow
• rolling semper-exp-current prerelease with machine-readable manifest/checksums
• explicit GPL corresponding-source snapshot generated from the exact public candidate after the ordinary build/release gate succeeds
• independent credential-free verification of the published source snapshot and SHA-256

Generator-validator boundary:

• all implementation/build material needed as GPL corresponding source remains public;
• the public source archive is generated from the exact reviewed public candidate, never from the private development repository;
• private A/B/C parity corpora, proprietary-data environments, adversarial/regression knowledge, compatibility matrices, and evaluator knowledge remain private when they are not required corresponding source.

This PR is being used as a public build/test gate only. Do not merge until private runtime/parity/no-side-effect validation is complete. No proprietary X-COM assets or private development history are included.

[mark-e-deyoung]

Build/distribution policy added at docs/SEMPERSUPRA-EXPERIMENTAL-BUILDS.md.

This PR remains a CI/review gate, not a release. Current policy reserves semper-oxce-experimental-... for future downloadable test artifacts and requires embedded SemperSupra provenance plus BUILD-INFO.txt so fork builds cannot be confused with official OXCE releases.

Windows CI has also been repaired: normal compile validation now pins windows-2022 and builds the solution's supported Release|Win32 configuration with the default VS2022 toolset. The obsolete Release_XP / v141_xp path is no longer a prerequisite for CI.

[mark-e-deyoung]

CI repair verification complete. Public run 32564504616 passed all three gates:

• Observer contract — PASS
• Full Linux engine build — PASS
• Full Windows engine build (windows-2022, Release|Win32) — PASS

The earlier Windows failure was caused by windows-latest moving to Windows Server 2025 / VS2026 while the old recipe attempted to modify a VS2022 installation and add the legacy XP toolset. The corrected compile gate pins Windows Server 2022 and uses the solution's ordinary supported Release configuration. PR remains draft/build-gate only.

[mark-e-deyoung]

Public experimental distribution channel is now live for this draft CI candidate.

Rolling prerelease:

• tag: semper-exp-current
• title: UNOFFICIAL — SemperSupra OXCE Experimental Build (8.6.5)
• Windows package: semper-oxce-experimental-8.6.5-g<sha>-windows-x86.zip (manifest marks it compatible with x86_64 Windows)
• Linux package: semper-oxce-experimental-8.6.5-g<sha>-linux-x86_64.AppImage
• machine contract: experimental-build-manifest.json
• human/tool checksum file: SHA256SUMS.txt

Packages are published only after observer-contract, full Linux engine, and full Windows engine gates pass. Build-time provenance identifies binaries as SemperSupra experimental; packages also contain BUILD-INFO.txt stating that they are unofficial and not published by MeridianOXC. No proprietary X-COM game data is included.

Latest run 32565607460 also passed Verify unauthenticated public channel. That job removes GitHub credentials, resolves the rolling prerelease through the public API, downloads its manifest and both platform packages through public URLs, verifies the candidate SHA and official_oxce:false, and recomputes every package SHA-256.

Current rolling candidate: 0d65009585896decb10558b1d56a0d6db36ed3f3.

This PR remains draft/build-and-distribution evidence only. Do not merge solely because the public build channel is green; private A/B/C semantic parity and side-effect validation remain separate gates.

[mark-e-deyoung]

Release-surface hardening checkpoint — 2026-08-30

Agent-generated review note; this does not change the engine candidate or constitute merge approval.

Independent review found one workflow hardening item: .github/workflows/compile-observer-smoke.yml currently permits publish-experimental to execute for a same-repository pull_request while granting that job contents: write. PR build/test feedback should remain available, but a PR should not be able to move semper-exp-current or replace release assets.

Tracked in #2: make publish-experimental and its downstream public-channel verification mutation path push-only on refs/heads/semper/compile-observer.

Do not patch the current candidate branch directly just to make this fix: a direct push is itself the rolling-release trigger. Prepare/review the workflow-only hardening separately, then merge deliberately when the candidate/promotion state is ready.

The engine semantic delta itself remains under the existing private runtime/A/B/C and side-effect gates.