FIX: Harden cross-platform release validation

[merefield]

Summary

• verify every release matrix job still checks out the immutable commit validated from the tag
• run an explicit native CLI build on Ubuntu, macOS, and Windows before publishing
• retain the existing hardened Windows installer fixture startup

Validation

• go vet ./...
• go test -race ./...
• go build -buildvcs=false -trimpath ./cmd/termcourse
• bats test (10 tests)
• Windows and macOS amd64 cross-builds

[Copilot]

🟢 Approval recommended

The workflow changes are small, consistent with the stated goals, and primarily add additional validation/build safety checks without altering release publishing semantics.

Pull request overview

This PR hardens the release pipeline by ensuring each OS job validates it is building/testing the exact immutable commit that was validated from the release tag, and by adding an explicit native go build step across the OS test matrix before publishing.

Changes:

• Add a post-checkout commit verification step in the OS matrix test job to ensure the checked-out commit matches the validated tag’s resolved commit SHA.
• Add an explicit go build -buildvcs=false -trimpath ./cmd/termcourse step to the OS matrix test job.
• Keep the existing Windows installer fixture test intact while running after the added build step.

File summaries

File	Description
.github/workflows/release.yml	Adds per-matrix-job commit immutability verification and an explicit native build step before release publication.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.