Harden source release preparation and record verified security follow-up

tools/release/prepare-developer-meta-package.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""Preview or explicitly prepare Meta outside a durable release run."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+from govoplan_release.meta_preparation import (
+    MetaPreparationAmbiguous,
+    MetaPreparationError,
+    _read_input,
+    prepare_developer_meta_package,
+)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--workspace", type=Path, required=True)
+    parser.add_argument("--target-version", required=True)
+    parser.add_argument("--apply", action="store_true")
+    parser.add_argument("--receipt", type=Path)
+    parser.add_argument("--confirm-out-of-run", action="store_true")
+    args = parser.parse_args()
+    try:
+        expected = None
+        if args.apply:
+            if args.receipt is None:
+                raise MetaPreparationError(
+                    "Apply requires the reviewed preview JSON via --receipt."
+                )
+            payload, _ = _read_input(args.receipt)
+            expected = json.loads(payload)["receipt"]
+        result = prepare_developer_meta_package(
+            repo_path=args.workspace.absolute() / "govoplan",
+            target_version=args.target_version,
+            apply=args.apply,
+            expected_receipt=expected,
+            confirm_out_of_run=args.confirm_out_of_run,
+        )
+    except (MetaPreparationError, OSError, ValueError, KeyError, TypeError) as exc:
+        status = "needs-reconciliation" if isinstance(exc, MetaPreparationAmbiguous) else "blocked"
+        print(json.dumps({"status": status, "detail": str(exc)}))
+        return 1
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())