fix: harden release validation

scripts/verify-clean-machine.sh

@@ -10,19 +10,31 @@ state="$work/state"
 bin="$work/bin"
 mkdir -p "$home" "$config" "$state" "$bin"
 
+snapshot_host_path() {
+  path=$1
+  if [ ! -e "$path" ] && [ ! -L "$path" ]; then
+    printf 'absent\t%s\n' "$path"
+    return
+  fi
+
+  # Avoid pipelines: traversal, stat, hash, and sort failures must stop the
+  # verification rather than being mistaken for an unchanged host snapshot.
+  find -H "$path" -xdev \
+    -exec stat --printf='metadata\t%F\t%a\t%u\t%g\t%N\n' -- {} + \
+    >"$work/host-snapshot-metadata"
+  LC_ALL=C sort "$work/host-snapshot-metadata"
+  find -H "$path" -xdev -type f -exec sha256sum -- {} + \
+    >"$work/host-snapshot-content"
+  LC_ALL=C sort "$work/host-snapshot-content"
+}
+
 snapshot_host() {
   for path in \
     "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.docker/config.json" \
-    /etc/apt/apt.conf.d/99proxyctl /etc/docker/daemon.json \
-    /var/lib/proxyctl/docker-daemon.json
+    /etc/apt/apt.conf.d /etc/docker/daemon.json /var/lib/proxyctl \
+    /etc/systemd/system/docker.service.d
   do
-    if [ -r "$path" ]; then
-      sha256sum "$path"
-    elif [ -e "$path" ]; then
-      ls -ld "$path"
-    else
-      printf 'absent  %s\n' "$path"
-    fi
+    snapshot_host_path "$path"
   done
   if command -v gsettings >/dev/null 2>&1; then
     gsettings get org.gnome.system.proxy mode 2>&1 || true