Reproducible package hardening
Makes root-deployment ZIPs byte-reproducible across clean extractions while preserving stable routes, APIs, content, discovery signals, and the dependency-free runtime contract.
- Normalized runtime ZIP member timestamps instead of copying source filesystem mtimes.
- Added independent same-source and clean-extraction rebuild proofs that require byte-identical archives and SHA-256 values.
- Enforced deterministic member ordering, canonical Unix ZIP metadata, compression, bytes, modes, and repository-only exclusions.
- Published compatible patch version 1.0.1 without changing canonical route or API contracts.
Release boundary: version metadata identifies the package; it does not claim that a local candidate is deployed. Production is authoritative only after a separately authorized deployment and fresh live verification.