[Eduardo Villalpando Mello (edvilme)]

Summary

• Clean TypeScript dist before compiling so deleted sources cannot leave obsolete outputs.
• Build paired TypeScript artifacts and a Python wheel from one isolated source snapshot using the shared npm lockfile and existing setuptools backend.
• Verify the exact shared Git pin, honest clean/dirty identity, input fingerprint, and complete artifact hashes. Reject stale, missing, extra, tampered, or mixed outputs.
• Check selected inputs against HEAD even when Git index flags hide edits/removals, while respecting line-ending normalization.
• Add focused regressions, existing nox lint integration, and generic build/verification documentation. Only test-submodules/ is newly ignored.

Related to #141. This delivers the generic source-build/provenance increment; consumer-pipeline adoption remains a follow-up. No runtime APIs, LSP payloads, dependency versions, or consumer lockfiles change.

Validation

• Built and verified all 58 paired artifact files from clean commit 2d89a5342fdebda1200447fe8246763d993dc9e0, without dirty opt-in, using Node 24.17.0 / npm 11.13.0 / Python 3.13.14.
• 8 source-build regression tests passed, including hidden edited/deleted inputs and clean CRLF normalization. The hidden-input regression failed in all four cases before the fix.
• TypeScript build and 152 tests passed with the pinned Node version; lint passed with two existing warnings.
• Existing Python suite: 346 passed, 2 skipped.
• New-script Black, isort, and flake8 checks passed; git diff --check passed.
• Reproduced stale output after deleting a compiled source; the updated ordinary build removes it.
• Existing TypeScript format-check failures on 14 production files are unrelated and unchanged.

Source/output verification does not claim cross-platform byte-identical wheels, supply-chain attestation, or consumer dependency compatibility. Local build-backend versions are recorded; no generic orchestration framework is introduced.