Add portable Linux packaging and verify distribution notices

scripts/test-windows-notices.ps1

@@ -14,6 +14,8 @@ function Write-Fixture([string]$Relative, [string]$Text) {
 }
 $null = Write-Fixture 'LICENSE' 'Synthetic workspace license for tests only'
 $null = Write-Fixture 'Cargo.toml' '[workspace]'
+$null = Write-Fixture 'docs/openapi.json' '{}'
+$null = Write-Fixture 'build/windows_manifest.rs' '// synthetic shared build input'
 $null = Write-Fixture 'rust/share/doc/rust/COPYRIGHT.html' 'Synthetic Rust distribution notice'
 $null = Write-Fixture 'rust/share/doc/rust/COPYRIGHT-library.html' 'Synthetic Rust library notice'
 $null = Write-Fixture 'rust/lib/fake.rlib' 'Synthetic target library'
@@ -42,8 +44,9 @@ foreach ($name in @('oa-desktop', 'oa-server', 'normal', 'build', 'dev-only', 'u
 }
 $null = Write-Fixture 'Cargo.lock' ($lock -join "`n")
 $script:FixtureMetadata = [pscustomobject]@{ packages = $packages; workspace_members = @('oa-desktop', 'oa-server'); resolve = [pscustomobject]@{ nodes = $nodes } }
+$script:FixtureTarget = 'x86_64-pc-windows-msvc'
 function cargo {
-    if (($args -join ' ') -notmatch '--locked --offline' -or ($args -join ' ') -notmatch '--filter-platform x86_64-pc-windows-msvc') { throw 'Unexpected Cargo command' }
+    if (($args -join ' ') -notmatch '--locked --offline' -or ($args -join ' ') -notmatch "--filter-platform $script:FixtureTarget") { throw 'Unexpected Cargo command' }
     $global:LASTEXITCODE = 0
     $script:FixtureMetadata | ConvertTo-Json -Depth 12
 }
@@ -66,6 +69,13 @@ $result = Collect
 $names = @($result.Inventory.packages | ForEach-Object { $_.name })
 Assert ($names.Count -eq 4 -and $names -contains 'normal' -and $names -contains 'build' -and $names -notcontains 'dev-only' -and $names -notcontains 'unreachable') 'Normal/build graph selection failed'
 Assert ($result.Inventory.rust.notices.Count -eq 2) 'Rust reports missing'
+Assert ($result.Inventory.workspace_build_inputs_sha256.Count -eq 5) 'Shared compiler input inventory missing'
+$script:FixtureTarget = 'x86_64-unknown-linux-gnu'
+$linuxNotices = Get-ArcadiaNotices $fixture $script:FixtureTarget $manifestPath '' @('oa-server')
+Assert ($linuxNotices.Inventory.packages.Count -eq 1 -and $linuxNotices.Inventory.packages[0].name -eq 'oa-server') 'Server-only Linux notice graph includes desktop roots'
+Assert ($linuxNotices.Inventory.root_packages.Count -eq 1 -and $linuxNotices.Inventory.root_packages[0] -eq 'oa-server' -and $null -eq $linuxNotices.Inventory.runtime) 'Linux target/root/runtime identity not retained'
+try { $null = Get-ArcadiaNotices $fixture $script:FixtureTarget $manifestPath 'unexpected-runtime'; throw 'Expected runtime refusal' } catch { if ($_.Exception.Message -notmatch 'only to the gnullvm target') { throw } }
+$script:FixtureTarget = 'x86_64-pc-windows-msvc'
 $before = ($result.Inventory.packages | Where-Object name -eq normal).local_source_sha256['src/lib.rs']
 $null = Write-Fixture 'registry/src/test/normal-1.0.0/src/lib.rs' '// locally changed source'
 $after = ((Collect).Inventory.packages | Where-Object name -eq normal).local_source_sha256['src/lib.rs']
@@ -73,9 +83,19 @@ Assert ($before -ne $after) 'Local source hash was replaced by a cached checksum
 $null = Write-Fixture 'registry/cache/test/normal-1.0.0.crate' 'Tampered archive'
 Refuses 'Cached crate archive differs'
 $null = Write-Fixture 'registry/cache/test/normal-1.0.0.crate' 'Synthetic cached archive normal'
+$null = Write-Fixture 'registry/src/test/normal-1.0.0/src/lib.rs' "//! include_bytes!(`"../../dev/absent.ttf`")`n    /// let font = include_bytes!(`"../../dev/absent.otf`");`n// include_bytes!(`"../../dev/absent.woff2`")`npub fn normal_code() {}"
+Assert (@((Collect).Inventory.packages | Where-Object name -eq normal).Count -eq 1) 'Rustdoc font examples incorrectly treated as compiled assets'
+$null = Write-Fixture 'registry/src/test/normal-1.0.0/src/lib.rs' 'static FONT: &[u8] = include_bytes!("../../dev/absent.ttf");'
+Refuses 'Embedded font path escapes crate source root'
 $null = Write-Fixture 'registry/src/test/normal-1.0.0/src/lib.rs' 'static FONT: &[u8] = include_bytes!("../font.ttf");'
 $null = Write-Fixture 'registry/src/test/normal-1.0.0/font.ttf' 'Synthetic font bytes'
 Refuses 'Embedded font requires exact notice mapping'
+$fontNotice = Write-Fixture 'supplements/font-OFL.txt' 'Synthetic exact font notice'
+$fontAsset = [ordered]@{ name = 'normal'; version = '1.0.0'; path = 'font.ttf'; sha256 = (Get-FileHash -LiteralPath (Join-Path $fixture 'registry/src/test/normal-1.0.0/font.ttf') -Algorithm SHA256).Hash.ToLowerInvariant(); license = 'OFL-1.1'; notices = @([ordered]@{ file = 'font-OFL.txt'; sha256 = (Get-FileHash -LiteralPath $fontNotice -Algorithm SHA256).Hash.ToLowerInvariant(); url = 'https://example.invalid/font-OFL.txt' }) }
+$null = Write-Fixture 'supplements/manifest.json' ([ordered]@{ packages = @(); assets = @($fontAsset); runtimes = @() } | ConvertTo-Json -Depth 8)
+Assert (@((Collect).Inventory.packages | Where-Object name -eq normal).Count -eq 1) 'Exact font mapping was rejected'
+$null = Write-Fixture 'registry/src/test/normal-1.0.0/font.ttf' 'Different font bytes'
+Refuses 'Embedded font requires exact notice mapping'
 $null = Write-Fixture 'registry/src/test/normal-1.0.0/src/lib.rs' '// no font'
 $pkg = $script:FixtureMetadata.packages | Where-Object name -eq normal
 $pkg.source = 'git+https://example.invalid/test#123'
@@ -89,5 +109,5 @@ $bad.packages[0].notices[0].file = 'NOTICE.txt'
 $null = Write-Fixture 'supplements/NOTICE.txt' 'Synthetic supplemental notice'
 $null = Write-Fixture 'supplements/manifest.json' ($bad | ConvertTo-Json -Depth 8)
 Refuses 'Supplement changed'
-Write-Output 'PASS: normal/build selection, Rust reports, actual local source hashes, stale archive refusal, unmapped font refusal, unsupported source refusal, traversal refusal, altered supplement refusal.'
+Write-Output 'PASS: normal/build and server-only Linux selection, cross-target runtime refusal, Rust reports, actual source hashes, stale archive refusal, doc-comment font exclusion, production font path/mapping refusals, exact font mapping and changed-byte refusal, unsupported source refusal, traversal refusal, altered supplement refusal.'
 Write-Output "Synthetic fixture retained for inspection: $fixture"