fix: make release deployment safely repeatable

test/distribution.test.ts

@@ -86,6 +86,11 @@ test("customer distribution is a generic single-login gateway bridge", () => {
 
   const deploy = readFileSync("deploy/install.sh", "utf8");
   assert.match(deploy, /--download-base-url "\$\{gitea_release_base_url\}"[\s\S]*--download-mirror-base-url "\$\{public_download_base_url\}"/s);
+  assert.match(deploy, /refs\/tags\/\$\{release_tag\}[\s\S]*release_created_at_commit="\$\{release_tag_commit:-\$\{release_commit\}\}"/s);
+  assert.match(deploy, /! -name 'agent-test-install\.md' ! -name 'dingmcp-test-bundle\.tar\.gz'/);
+
+  const testBundleBuilder = readFileSync("scripts/build-test-bundle.mjs", "utf8");
+  assert.match(testBundleBuilder, /--sort=name.*--mtime=@0.*--owner=0.*--group=0.*--numeric-owner.*--format=ustar/s);
 });
 
 test("public install page explicitly declares UTF-8 for browser rendering", () => {
@@ -95,3 +100,18 @@ test("public install page explicitly declares UTF-8 for browser rendering", () =
   assert.match(installLocation, /charset utf-8;/);
   assert.match(installLocation, /charset_types text\/markdown;/);
 });
+
+test("Gitea release lookup tolerates tea field-name corruption and fails closed", () => {
+  const lookup = (body: string, tag = "v1.1.0-rc.11") => spawnSync(
+    process.execPath,
+    ["scripts/release-tag-exists.mjs", tag],
+    { input: body, encoding: "utf8" },
+  );
+  assert.equal(lookup('[{"tag_name":"v1.1.0-rc.11"}]').status, 0);
+  assert.equal(lookup('[{"tag-_name":"v1.1.0-rc.11"}]').status, 0);
+  assert.equal(lookup('{"data":[{"Tag":"v1.1.0-rc.11"}]}').status, 0);
+  assert.equal(lookup('[{"tag-_name":"v1.1.0-rc.10"}]').status, 1);
+  const invalid = lookup("not json");
+  assert.equal(invalid.status, 2);
+  assert.match(invalid.stderr, /无法解析/);
+});