Harden release source execution

tools/release/govoplan_release/module_directory.py

@@ -44,7 +44,15 @@ def module_directory_payloads(
     public_base_url: str = DEFAULT_PUBLIC_BASE_URL,
 ) -> tuple[tuple[Path, dict[str, Any]], ...]:
     channel = validate_release_channel(channel)
-    generated_at = json_datetime(datetime.now(tz=UTC))
+    # Publication artifacts must be reproducible from the signed catalog so an
+    # interrupted push can later be reconciled against the immutable commit.
+    # Older/ad-hoc callers without a catalog timestamp retain the old fallback.
+    catalog_generated_at = catalog_payload.get("generated_at")
+    generated_at = (
+        catalog_generated_at
+        if isinstance(catalog_generated_at, str) and catalog_generated_at
+        else json_datetime(datetime.now(tz=UTC))
+    )
     modules = module_rows(catalog_payload)
     compatibility = compatibility_rows(modules)
     signatures = signature_rows(catalog_payload, keyring_payload)