test: verify SHA-256 hash determinism for public release

[shaypal5]

Summary

• Adds scripts/verify_hash_determinism.py — runs scripts/build_public_release.py twice into temp directories with the same seed/config and asserts every generated file hashes identically across runs.
• Enforces the architectural invariant "generation is deterministic given (recipe, config, seed, version)" on the bundle layer.
• Last actionable check before the manual upload/announce steps in Phase 5 of the public release.

How manifest.json is handled

build_manifest() stamps generation_timestamp with datetime.now(UTC), so manifest.json bytes legitimately differ between runs. The script strips that one field and compares the remaining payload (which already carries per-file SHA-256 digests for the relational and task Parquet files). Every other file is compared byte-for-byte.

Verification result

Ran locally on main + this branch:

Run A produced 73 files; run B produced 73 files.
PASS: all 73 files hash identically across runs.
(manifest.json compared after stripping generation_timestamp, which is wall-clock by design.)

All four bundles (intro, intermediate, advanced, intermediate_instructor) plus LICENSE are byte-identical across runs.

Test plan

• python scripts/verify_hash_determinism.py exits 0 and prints PASS
• ruff check scripts/verify_hash_determinism.py clean
• ruff format --check scripts/verify_hash_determinism.py clean
• CI green

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a release-validation script that enforces the repo’s “public release build is deterministic given (recipe, config, seed, version)” invariant by rebuilding the public release twice and comparing SHA-256 hashes for all generated files (with a targeted exception for manifest.json’s wall-clock generation_timestamp).

Changes:

• Add scripts/verify_hash_determinism.py to run build_public_release.py twice into temp dirs and compare per-file hashes (special-casing manifest.json by stripping generation_timestamp before comparing payloads).
• Update .agent-plan.md to mark the determinism verification step as completed and document the local verification result.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
scripts/verify_hash_determinism.py	New verification script to confirm byte-level determinism of the public release artifacts (except manifest.json timestamp field).
.agent-plan.md	Marks the determinism verification checklist item as completed and records the observed result.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

pr-agent-context report:

This run includes an unresolved review comment on PR #55 in repository https://github.com/leadforge-dev/leadforge

For each unresolved review comment, recommend one of: resolve as irrelevant, accept and implement
the recommended solution, open a separate issue and resolve as out-of-scope for this PR, accept and
implement a different solution, or resolve as already treated by the code.

After I reply with my decision per item, implement the accepted actions, resolve the corresponding
PR comments, and push all of these changes in a single commit.

# Copilot Comments

## COPILOT-1
Location: scripts/verify_hash_determinism.py
URL: https://github.com/leadforge-dev/leadforge/pull/55#discussion_r3180123178
Status: outdated
Root author: copilot-pull-request-reviewer

Comment:
    This script adds comparison logic (tree hashing plus special-casing `manifest.json`), but there are no tests exercising `compare()`/`manifest_payload_without_timestamp()`. Consider adding a small unit test (e.g., two temp dirs with `manifest.json` differing only by `generation_timestamp`) to prevent regressions in the determinism check itself.

Run metadata:

Tool ref: v4
Tool version: 4.0.21
Trigger: commit pushed
Workflow run: 25308287377 attempt 1
Comment timestamp: 2026-05-04T08:12:40.087587+00:00
PR head commit: 48ad332baaee3a3c0d5c247fb60c30760c1ef4ad