fix: restore cross-platform release packaging

The unpublished 0.11.3 candidate could not validate the DeepSeek Harness node-pty prebuilds on every native target, and catalog signing could misread large compound Agent payloads. Release packaging now verifies the rc.8 native layout and writes deterministic stored .gbagent archives with bounded central-directory, mode, CRC, SHA-256, and signature checks.

The 0.11.4 recovery also pins reviewed dependency lifecycle scripts, packages the omitted ONNX Runtime license, and carries the approved unpublished notes forward without changing the immutable failed tags or adding a LoongArch package.

Release note: 修复跨平台桌面包和大文件 Agent 包的发行校验失败，并将未发布的 0.11.3 内容顺延至 0.11.4。

tests/agent-package.test.ts

@@ -107,6 +107,14 @@ type AgentPackageModule = {
 }
 
 type AgentCatalogModule = {
+  readPackageMetadata(
+    archivePath: string,
+    registry: AgentReleaseKeyRegistry
+  ): {
+    descriptor: AgentPackageDescriptor
+    size: number
+    sha256: string
+  }
   createCatalog(options: {
     projectRoot: string
     x64Package: string
@@ -289,6 +297,12 @@ describe('compound Agent packages', () => {
         'remote-runtime-lock.json'
       ])
     )
+    expect(packageResult.descriptor.files).toContainEqual(
+      expect.objectContaining({
+        path: 'agent/helpers/fixture-helper',
+        mode: '0755'
+      })
+    )
 
     const contentRoot = join(temporaryRoot, 'verified')
     const verified = await extractAndVerifyAgentPackage({
@@ -576,12 +590,15 @@ describe('compound Agent packages', () => {
       changedRoot,
       agentPackageArchiveName(agentLock.agentVersion, 'x64')
     )
-    const changedEntries = unzipSync(
-      new Uint8Array(readFileSync(packagePath))
-    )
+    const originalPackage = readFileSync(packagePath)
+    const changedPackage = Buffer.concat([
+      originalPackage,
+      Buffer.from([0])
+    ])
+    changedPackage.writeUInt16LE(1, originalPackage.length - 2)
     writeFileSync(
       changedPath,
-      Buffer.from(zipSync(changedEntries, { level: 1 }))
+      changedPackage
     )
     expect(() =>
       agentCatalog.createCatalog({
@@ -608,6 +625,18 @@ describe('compound Agent packages', () => {
     ).toThrow('identity is immutable')
   })
 
+  it('verifies stored payload bytes that contain a ZIP descriptor signature', () => {
+    expect(
+      agentCatalog.readPackageMetadata(packagePath, registry)
+    ).toMatchObject({
+      descriptor: {
+        architecture: 'x64'
+      },
+      size: packageResult.size,
+      sha256: packageResult.sha256
+    })
+  })
+
   it('imports and exports a fully verified offline package atomically', async () => {
     const keyRegistryPath = join(
       temporaryRoot,
@@ -884,6 +913,7 @@ function writeAgentBundle(
 ): void {
   mkdirSync(join(directory, 'lib'), { recursive: true })
   mkdirSync(join(directory, 'licenses'), { recursive: true })
+  mkdirSync(join(directory, 'helpers'), { recursive: true })
   writeFileSync(join(directory, 'node'), elf(architecture))
   writeFileSync(
     join(directory, 'goodbuddy-agent'),
@@ -893,6 +923,10 @@ function writeAgentBundle(
     join(directory, 'lib', 'agent.cjs'),
     'module.exports={}\n'
   )
+  writeFileSync(
+    join(directory, 'helpers', 'fixture-helper'),
+    '#!/bin/sh\n'
+  )
   for (const [name, contents] of [
     ['GoodBuddy-0BSD.txt', '0BSD'],
     ['Node.js-MIT.txt', 'MIT'],
@@ -903,7 +937,11 @@ function writeAgentBundle(
     writeFileSync(join(directory, 'licenses', name), contents)
   }
   writeKoffiPayload(directory, architecture)
-  for (const path of ['node', 'goodbuddy-agent']) {
+  for (const path of [
+    'node',
+    'goodbuddy-agent',
+    'helpers/fixture-helper'
+  ]) {
     chmodSync(join(directory, path), 0o755)
   }
   const manifest = agentBundle.createManifest(directory, {
@@ -1027,7 +1065,11 @@ function createRuntimeInput(
   )
   writeFileSync(
     join(packageRoot, 'bin', 'opencode'),
-    elf(architecture)
+    Buffer.concat([
+      elf(architecture),
+      Buffer.from([0x50, 0x4b, 0x07, 0x08]),
+      Buffer.from('runtime payload')
+    ])
   )
   chmodSync(join(packageRoot, 'bin', 'opencode'), 0o755)
   const archive = join(