Always validate and freeze the exact successful build artifact

After each successful candidate build, run a fresh smoke test against that exact artifact—not a source checkout or later rebuild. Use an isolated disposable environment with separate HOME/XDG/database paths and loopback ports. Exercise restart-sensitive behavior such as migration, authenticated health, clean shutdown, recovery promotion, idempotence, and duplicate-free or exactly-once recovery across restarts. Hash the tested artifact and freeze those hashes only after validation succeeds. Treat known bundle-size or chunking warnings as non-blocking when the build otherwise succeeds, and use fresh reviewers for subsequent focused reviews when requested.