Harden source release preparation and record verified security follow-up

tools/release/govoplan_release/version_metadata.py

@@ -34,6 +34,19 @@ def version_metadata_mutations(
 ) -> tuple[VersionFileMutation, ...]:
     """Render all recognized repository version files without writing them."""
 
+    from .git_state import registered_developer_meta_path
+
+    if registered_developer_meta_path(repo_path) is not None:
+        from .meta_preparation import MetaPreparationError, PACKAGE, preview_meta_mutation
+
+        try:
+            _receipt, before, after = preview_meta_mutation(
+                repo_path=repo_path, target_version=target_version,
+            )
+        except (MetaPreparationError, OSError, ValueError, KeyError, TypeError) as exc:
+            raise VersionMetadataError(str(exc)) from exc
+        return (VersionFileMutation(PACKAGE, before, after),) if before != after else ()
+
     version = target_version.removeprefix("v")
     candidates: list[tuple[Path, str]] = []
     if (repo_path / "pyproject.toml").is_file():
@@ -115,6 +128,14 @@ def apply_version_metadata_mutations(
 ) -> tuple[str, ...]:
     """Apply one deterministic version update, rolling back on write failure."""
 
+    from .git_state import registered_developer_meta_path
+
+    if registered_developer_meta_path(repo_path) is not None:
+        raise VersionMetadataError(
+            "Meta is prepared outside durable runs with prepare-developer-meta-package.py; "
+            "review its complete generated composition, commit, and create a fresh run."
+        )
+
     mutations = version_metadata_mutations(
         repo_path,
         target_version=target_version,