feat(ci): add cross-platform final build checks

[konard]

Summary

• Adds a Final Build GitHub Actions workflow for Ubuntu, macOS, and Windows that builds both packages, smoke-tests both CLIs, and uploads package tarballs.
• Makes setup/package scripts cross-platform by removing shell-only script wrappers and replacing raw chmod with a Bun helper.
• Bounds clone-cache mirror refreshes to branch and tag refs so CI does not fetch hosted forge PR refs during cache reuse.

Reproduction and Verification

• Reproduced the package-script portability gap with packages/app/tests/docker-git/package-scripts-cross-platform.test.ts before implementing the script changes.
• Reproduced the clone-cache CI failure mode from run 25728183189: E2E (Clone cache) timed out after 1800s on the second cache reuse case while refreshing broad refs/*.
• Added a regression test in packages/lib/tests/core/templates.test.ts proving mirror refreshes include refs/heads/* and refs/tags/* but not broad refs/*.

Local Checks

• bun run --cwd packages/lib test -- tests/core/templates.test.ts
• bun run --cwd packages/app test -- tests/docker-git/package-scripts-cross-platform.test.ts
• bun run build
• bun run typecheck
• bun run lint
• bun run lint:effect
• bun run check:dist-deps-prune
• bun run test
• git diff --check

Mathematical Guarantees

Invariants

• forall os in {linux, macos, windows}: final-build(os) -> build(os) and cli_help(app, os) and cli_help(session_sync, os)
• forall r in clone_cache_refresh_refs: r in refs/heads/* union refs/tags/*
• forall npm_script in checked_scripts: not contains(npm_script, "bash -lc")

Preconditions

• Bun and Node versions are provided by the shared setup action.
• Generated dist artifacts exist before package smoke checks.

Postconditions

• Package tarballs are produced on each matrix OS.
• Clone-cache refresh no longer requests refs/pull/* or refs/merge-requests/* through broad refs/*.

Complexity

• Clone-cache refresh changes from O(|all remote refs|) to O(|heads| + |tags|).

SOURCE: n/a

Fixes #278

[konard]

Working session summary

Done. Updated existing PR 279 and marked it ready:

#279

Implemented:

• Added cross-platform Final Build workflow for Ubuntu, macOS, and Windows.
• Removed Unix-only script assumptions from package scripts.
• Added executable marking helper with Windows no-op behavior.
• Fixed clone-cache mirror refresh to fetch only heads/tags instead of all refs.
• Added regression tests for cross-platform scripts and clone-cache refspec invariants.

Verified locally:
build, typecheck, lint, lint:effect, check:dist-deps-prune, full test, targeted regression tests, and git diff --check.

Verified CI on latest SHA a872a79230edcea7405200a732154568f2051d81:
Check, Final Build, Snapshot, and Checking Dependencies all passed. Working tree is clean.

SOURCE: n/a.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.5
• Provider: OpenAI
• Public pricing estimate: $31.863471

📊 Context and tokens usage:

• 672.7K / 1.1M (64%) input tokens, 61.0K / 128K (48%) output tokens

Total: (672.7K + 22.4M cached) input tokens, 61.0K output tokens, $31.863471 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.5
• Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Repository (83153KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag

[skulidropek]

в Final build надо ещё проверить что запускается browser
И через менюшку у него работает клонирование проектов