feat: bind schema verification to release manifest

cmd/orbit-admin/release_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"os"
+	"path/filepath"
 	"testing"
 
 	"git.yuntuo.hk/k2safe/orbit/internal/buildinfo"
@@ -51,6 +52,35 @@ func TestReleaseManifestRejectsUnknownCommand(t *testing.T) {
 	}
 }
 
+func TestReleaseManifestValidationBindsBinaryIdentity(t *testing.T) {
+	manifest, err := currentReleaseManifest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(t.TempDir(), "release-manifest.json")
+	encoded, err := json.Marshal(manifest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, encoded, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := validateReleaseManifest(path); err != nil {
+		t.Fatalf("matching manifest rejected: %v", err)
+	}
+	manifest.Build.Revision = "different-release"
+	encoded, err = json.Marshal(manifest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, encoded, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if err := validateReleaseManifest(path); err == nil {
+		t.Fatal("manifest with different revision accepted")
+	}
+}
+
 func captureStdout(t *testing.T) (*bytes.Buffer, func()) {
 	t.Helper()
 	old := os.Stdout