Add portable Linux packaging and verify distribution notices

scripts/package-windows.ps1

@@ -11,6 +11,8 @@ param(
     [Parameter(Mandatory = $true)]
     [string]$BinaryDirectory,
     [string]$LlvmMinGWRoot,
+    [string]$BuildEvidence,
+    [string]$Python = 'python',
     [string]$NoticeManifest = (Join-Path $PSScriptRoot 'windows-notices/manifest.json'),
     [string]$OutputRoot = (Join-Path $PSScriptRoot '../dist')
 )
@@ -19,6 +21,7 @@ Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 $repository = [IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
 $utf8 = New-Object Text.UTF8Encoding($false)
+. (Join-Path $PSScriptRoot 'package-common.ps1')
 
 function Require-File([string]$Path) {
     if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { throw "Required file missing: $Path" }
@@ -121,21 +124,11 @@ foreach ($name in @($inputs.Keys | Where-Object { $_ -match '\.(exe|dll)$' })) {
     }
 }
 
-foreach ($name in @('README.md', 'LICENSE')) { $inputs[$name] = Require-File (Join-Path $repository $name) }
-$tracked = @(& git -C $repository -c core.quotepath=false ls-files -- docs examples deployment)
-if ($LASTEXITCODE -ne 0 -or $tracked.Count -eq 0) { throw 'A Git checkout and tracked docs/examples/deployment inputs are required.' }
-foreach ($relative in $tracked) {
-    $source = Require-File (Join-Path $repository $relative)
-    if (((Get-Item -LiteralPath $source).Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) {
-        throw "Package input must not be a symlink: $source"
-    }
-    $inputs[$relative] = $source
-}
-# Explicitly require the packaging guide, including before its first commit.
-$inputs['docs/windows-packaging.md'] = Require-File (Join-Path $repository 'docs/windows-packaging.md')
-foreach ($name in @('release-current-coverage-20260906.md', 'release-save-as-runtime-packaging.md')) {
-    $inputs["harness/$name"] = Require-File (Join-Path $repository "harness/$name")
-}
+$binaryHashes = [ordered]@{}
+foreach ($name in @('arcadia-studio.exe', 'arcadia-server.exe')) { $binaryHashes[$name] = $inspectedHashes[$name] }
+$evidence = Read-PackageBuildEvidence $BuildEvidence $Target $binaryHashes
+$documentation = Get-PackageDocumentation $repository 'windows' $Python
+foreach ($name in $documentation.Keys) { $inputs[$name] = $documentation[$name] }
 
 # Resolve notice/source inputs before creating an output claim. No Cargo build occurs.
 . (Join-Path $PSScriptRoot 'windows-notices.ps1')
@@ -167,6 +160,7 @@ try {
     [void][IO.Directory]::CreateDirectory($stage)
     $inputHashes = [ordered]@{}
     foreach ($name in $inputs.Keys) {
+        Assert-PackageOrdinaryFile $inputs[$name]
         $destination = Join-Path $stage $name
         [void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($destination))
         $before = (Get-FileHash -LiteralPath $inputs[$name] -Algorithm SHA256).Hash.ToLowerInvariant()
@@ -183,13 +177,10 @@ try {
         version = $Version; target = $Target
         acceptance = 'Packaging integrity only; native clean-environment verification required.'
         build = 'Prebuilt inputs supplied by caller; this script does not establish build profile or source revision.'
-        imports = $imports; input_sha256 = $inputHashes
+        build_evidence = $evidence; imports = $imports; input_sha256 = $inputHashes
     }
-    [IO.File]::WriteAllText((Join-Path $stage 'package.json'), ($metadata | ConvertTo-Json -Depth 6) + "`n", $utf8)
-    [IO.File]::WriteAllText((Join-Path $stage 'dependency-notices.json'), ($notices.Inventory | ConvertTo-Json -Depth 14) + "`n", $utf8)
-    $noticeIndex = @('Third-party notice inventory', '', 'Exact package versions, license expressions, source hashes and notice paths:', 'dependency-notices.json', '', 'License texts and embedded-asset notices are retained under licenses/.', 'Rust distribution library/copyright reports are retained under licenses/rust/.', 'Collection is conservative; it does not establish binary/source equivalence or constitute a universal license audit.', '')
-    foreach ($package in $notices.Inventory.packages) { $noticeIndex += "$($package.name) $($package.version) -- $($package.license) -- licenses/dependencies/$($package.name)-$($package.version)/" }
-    [IO.File]::WriteAllText((Join-Path $stage 'THIRD-PARTY-NOTICES.txt'), ($noticeIndex -join "`n") + "`n", $utf8)
+    [IO.File]::WriteAllText((Join-Path $stage 'package.json'), ($metadata | ConvertTo-Json -Depth 14) + "`n", $utf8)
+    Write-PackageNotices $stage $notices
     $start = @'
 Arcadia Studio portable Windows bundle
 
@@ -201,9 +192,11 @@ Keep the bundled runtime DLL beside both executables when present. No compiler
 installation or machine PATH change is required by the staged runtime closure.
 This binary bundle does not include repository sources needed for Cargo/Docker
 build commands. Packaging integrity is not native release acceptance; read
-package.json and harness/release-current-coverage-20260906.md for limitations.
+package.json and the distributor's binary-specific acceptance record for limitations.
 '@
     [IO.File]::WriteAllText((Join-Path $stage 'START-HERE.txt'), $start + "`n", $utf8)
+    $documentCheck = Invoke-PackageHelper $Python @('check-docs', '--stage', $stage)
+    [IO.File]::WriteAllText((Join-Path $stage 'documentation-check.json'), ($documentCheck | ConvertTo-Json) + "`n", $utf8)
     $manifest = New-Object 'Collections.Generic.List[string]'
     foreach ($file in Get-ChildItem -LiteralPath $stage -Recurse -File | Sort-Object FullName) {
         $relative = $file.FullName.Substring($stage.Length + 1).Replace('\', '/')