fix: reject runtime files in release candidates

.gitignore

@@ -12,4 +12,5 @@ logs/
 .adm-api.pid
 .adm-dev.pid
 .adm-preview.pid
+*.pid
 release-candidates/

.h5-server.pid

@@ -1 +0,0 @@
-41863

scripts/.releaseignore-prod

@@ -7,6 +7,7 @@
 .adm-api.pid
 .adm-dev.pid
 .adm-preview.pid
+*.pid
 .claude
 .mindops
 node_modules

scripts/check-gray-ready.sh

@@ -53,8 +53,9 @@ fi
 
 manifest="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.manifest.txt' -print -quit)"
 sha_file="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.sha256' -print -quit)"
-[[ -n "${manifest}" && -n "${sha_file}" ]] || {
-  echo "Candidate manifest or checksum file missing in ${CANDIDATE_DIR}" >&2
+bundle="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.tar.gz' -print -quit)"
+[[ -n "${manifest}" && -n "${sha_file}" && -n "${bundle}" ]] || {
+  echo "Candidate bundle, manifest, or checksum file missing in ${CANDIDATE_DIR}" >&2
   exit 1
 }
 
@@ -63,6 +64,12 @@ sha_file="$(find "${CANDIDATE_DIR}" -maxdepth 1 -type f -name '*.sha256' -print
   shasum -a 256 -c "$(basename "${sha_file}")"
 )
 
+if tar -tzf "${bundle}" | grep -Eq '(^|/)(\.env($|\.)|[^/]*\.pid$|src/|release-candidates/)'; then
+  echo "Candidate contains forbidden runtime or development assets" >&2
+  tar -tzf "${bundle}" | grep -E '(^|/)(\.env($|\.)|[^/]*\.pid$|src/|release-candidates/)' >&2 || true
+  exit 1
+fi
+
 manifest_value() {
   local key="$1"
   sed -n "s/^${key}=//p" "${manifest}" | head -n 1