Harden source release preparation and record verified security follow-up

tools/release/govoplan_release/git_state.py

@@ -11,7 +11,7 @@ import tomllib
 
 from .contracts import parse_manifest_contract
 from .model import RepositorySnapshot, RepositorySpec, VersionSnapshot
-from .workspace import resolve_repo_path
+from .workspace import load_repository_specs, resolve_repo_path
 
 
 def collect_repository_snapshot(
@@ -98,6 +98,7 @@ def collect_repository_snapshot(
 def collect_versions(path: Path) -> VersionSnapshot:
     return VersionSnapshot(
         pyproject=read_pyproject_version(path),
+        developer_meta=read_developer_meta_version(path),
         package=read_json_version(path / "package.json"),
         webui_package=read_json_version(path / "webui" / "package.json"),
         manifests=read_manifest_versions(path),
@@ -105,6 +106,35 @@ def collect_versions(path: Path) -> VersionSnapshot:
     )
 
 
+def registered_developer_meta_path(path: Path) -> Path | None:
+    """Recognize only the catalog's explicit Meta support-repository identity.
+
+    This is metadata discovery, not authorization to access a remote or mutate
+    a checkout. Tagging applies its separate registered source trust contract.
+    """
+    for spec in load_repository_specs(include_website=False):
+        if (
+            spec.name == "govoplan"
+            and spec.category == "system"
+            and spec.subtype == "meta"
+            and path.absolute() == resolve_repo_path(spec, path.parent).absolute()
+        ):
+            return path / "packages" / "govoplan-meta" / "pyproject.toml"
+    return None
+
+
+def read_developer_meta_version(path: Path) -> str | None:
+    package = registered_developer_meta_path(path)
+    if package is None or not package.is_file():
+        return None
+    with package.open("rb") as handle:
+        project = tomllib.load(handle).get("project")
+    if isinstance(project, dict) and project.get("name") == "govoplan":
+        version = project.get("version")
+        return version if isinstance(version, str) else None
+    return None
+
+
 def read_pyproject_version(path: Path) -> str | None:
     pyproject = path / "pyproject.toml"
     if not pyproject.exists():