ci: gate releases on fresh fabro-spa assets

Add a verify-spa job to the release workflow that rebuilds the SPA
and fails if committed assets are stale, and add the same check to
bin/dev/release.sh so tagging fails before anything is pushed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -14,8 +14,21 @@ env:
   SEGMENT_WRITE_KEY: ${{ secrets.SEGMENT_WRITE_KEY }}
 
 jobs:
+  verify-spa:
+    name: Verify SPA assets
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2
+      - run: bun install
+      - run: scripts/refresh-fabro-spa.sh
+      - run: git diff --exit-code -- lib/crates/fabro-spa/assets
+
   compile:
     name: Compile (${{ matrix.target }})
+    needs: verify-spa
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false

bin/dev/release.sh

@@ -90,9 +90,22 @@ EOF
   done
 }
 
+verify_spa_assets() {
+  local repo_root
+  repo_root="$(git rev-parse --show-toplevel)"
+
+  "${repo_root}/scripts/refresh-fabro-spa.sh"
+
+  if ! git -C "$repo_root" diff --exit-code -- lib/crates/fabro-spa/assets >/dev/null; then
+    die "fabro-spa assets are stale. Commit the refreshed assets before releasing."
+  fi
+}
+
 main() {
   parse_args "$@"
 
+  verify_spa_assets
+
   local repo_root cargo_toml current_version base_version new_version tag
   repo_root="$(git rev-parse --show-toplevel)"
   cargo_toml="${repo_root}/Cargo.toml"