ci: enforce reproducible quality gates

scripts/check_diff.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ -n "${GITHUB_BASE_REF:-}" ]] && git rev-parse --verify --quiet "origin/$GITHUB_BASE_REF" >/dev/null; then
+  git diff --check "origin/$GITHUB_BASE_REF...HEAD"
+elif [[ -n "${GITHUB_EVENT_BEFORE:-}" ]] && [[ "$GITHUB_EVENT_BEFORE" != "0000000000000000000000000000000000000000" ]] && git cat-file -e "$GITHUB_EVENT_BEFORE^{commit}" 2>/dev/null; then
+  git diff --check "$GITHUB_EVENT_BEFORE..HEAD"
+elif git rev-parse --verify --quiet HEAD^ >/dev/null; then
+  git diff --check HEAD^..HEAD
+else
+  git diff --check HEAD
+fi
+
+git diff --check

scripts/record_release_demo.mjs

@@ -87,6 +87,7 @@ async function tap(selector, after = 650) {
 }
 
 await caption(`TIMMY ${version} • FEATURE DEMO`, 1300);
+await caption('Automated checks replay this synthetic path before review', 1300);
 await caption('New path: private, photo-first stool logging', 1100);
 await tap('[data-scan]', 500);
 await page.getByText(/Self-hosted model ready/i).waitFor();