build: package CLI with pinned producer verifier

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

scripts/release_cli.py

@@ -0,0 +1,29 @@
+"""Narrow installed CLI entry point; rendered by build_release_bundle.py."""
+import hashlib
+import os
+from pathlib import Path
+import sys
+
+EXPECTED_HELPER_SHA256 = "@HELPER_SHA256@"
+
+
+def main():
+    prefix = Path(__file__).resolve().parent.parent
+    helper = prefix / "libexec" / "secrets-engine-pdp-verify"
+    try:
+        if helper.is_symlink() or not helper.is_file():
+            raise ValueError("missing helper")
+        if hashlib.sha256(helper.read_bytes()).hexdigest() != EXPECTED_HELPER_SHA256:
+            raise ValueError("changed helper")
+    except (OSError, ValueError):
+        print("secrets-engine: installed verifier missing or changed", file=sys.stderr)
+        return 1
+    # The bundle always uses its reviewed helper; ambient overrides do not select
+    # another executable. The owner admits runtime trust separately.
+    os.environ["SECRETS_ENGINE_PDP_VERIFIER"] = str(helper)
+    from secrets_engine.cli import main as cli_main
+    return cli_main()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())