fix(release): handle Windows cleanup and align kit lock [skip ci]

Strip Windows PowerShell's UTF8 BOM before parsing normal cleanup
receipts. Run the existing bounded exact-private-path cleanup fallback
on failures even when its controller has already exited, verify its
returned path and zero remaining Terminal processes, and retain the
original failure result.

Use Cargo's conservative offline update for the standalone vendored
kit lock: app-server-protocol0.10.3 and its declared chrono edge. Root
Cargo.lock and runtime Rust sources are unchanged from4ba0c656ac9c.

Verified on the frozen4ba+these2paths: existing standalone kit themes
14passed/0failed; surfaces3passed/0failed, both locked/offline with
source unchanged and disk guard retained. Node syntax and diff checks
exit0. Independent review confirms both Windows findings are closed.
Actual PowerShell/Windows execution remains pending finalCI.

Mac4ba CLI build and strict HTTP admission/recovery observations passed;
Linux4ba-equivalent CLI build passed with full4270source invariants.
Those executables retain their exact4ba identity and scope; this commit
is not a claim that they were rebuilt from the later script/kit-lock
metadata. No publication or deployment.

scripts/release/windows-terminal-clipboard.mjs

@@ -120,7 +120,7 @@ try {
   receipt.stash = { path: stashFile, sha256: createHash('sha256').update(stashBytes).digest('hex'), records: 1, exactDraftMatch: true, normalization: 'CRLF to LF only' };
   assert.equal(await desktopClosed, 0, desktopError);
   assert.equal(desktopError, '', 'no desktop errors');
-  receipt.cleanup = JSON.parse(await fs.readFile(path.join(evidence, 'cleanup.json'), 'utf8'));
+  receipt.cleanup = JSON.parse((await fs.readFile(path.join(evidence, 'cleanup.json'), 'utf8')).replace(/^\uFEFF/, ''));
   assert.equal(receipt.cleanup.terminal, terminal, 'cleanup used the owned Terminal path');
   assert.equal(receipt.cleanup.remaining, 0, 'owned Terminal processes are gone');
   receipt.result = 'passed';
@@ -135,18 +135,22 @@ try {
         await fs.writeFile(path.join(evidence, 'cancel'), 'retire owned Terminal');
         await Promise.race([desktopClosed, delay(5000)]);
       } catch (error) { receipt.desktop.cancelError = String(error); }
-      if (desktop.exitCode === null && desktop.signalCode === null) {
-        try {
-          const cleanup = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
-            '$ErrorActionPreference = "Stop"; $terminal = $env:CODEWHALE_CLIPBOARD_TERMINAL; $stopped = @(); foreach ($process in @(Get-Process | Where-Object { $_.Path -eq $terminal })) { Stop-Process -InputObject $process -Force; if (!$process.WaitForExit(5000)) { throw "Owned Terminal did not exit" }; $stopped += $process.Id }; $remaining = @(Get-Process | Where-Object { $_.Path -eq $terminal }).Count; if ($remaining) { throw "Owned Terminal is still running" }; @{ terminal = $terminal; stopped = $stopped; remaining = $remaining } | ConvertTo-Json -Compress'],
-          { env: { ...desktopEnv, CODEWHALE_CLIPBOARD_TERMINAL: terminal }, encoding: 'utf8', timeout: 10_000 });
-          receipt.desktop.fallbackCleanup = JSON.parse(cleanup.replace(/^\uFEFF/, ''));
-        } catch (error) {
-          receipt.desktop.cleanupError = String(error); receipt.result = 'failed'; process.exitCode = 1;
-        }
-        receipt.desktop.killRequestedAt = new Date().toISOString(); desktop.kill();
+    }
+    if (receipt.result !== 'passed') {
+      try {
+        const cleanup = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+          '$ErrorActionPreference = "Stop"; $terminal = $env:CODEWHALE_CLIPBOARD_TERMINAL; $stopped = @(); foreach ($process in @(Get-Process | Where-Object { $_.Path -eq $terminal })) { Stop-Process -InputObject $process -Force; if (!$process.WaitForExit(5000)) { throw "Owned Terminal did not exit" }; $stopped += $process.Id }; $remaining = @(Get-Process | Where-Object { $_.Path -eq $terminal }).Count; if ($remaining) { throw "Owned Terminal is still running" }; @{ terminal = $terminal; stopped = $stopped; remaining = $remaining } | ConvertTo-Json -Compress'],
+        { env: { ...desktopEnv, CODEWHALE_CLIPBOARD_TERMINAL: terminal }, encoding: 'utf8', timeout: 10_000 });
+        receipt.desktop.fallbackCleanup = JSON.parse(cleanup.replace(/^\uFEFF/, ''));
+        assert.equal(receipt.desktop.fallbackCleanup.terminal, terminal, 'fallback cleanup used the owned Terminal path');
+        assert.equal(receipt.desktop.fallbackCleanup.remaining, 0, 'fallback cleanup retired the owned Terminal');
+      } catch (error) {
+        receipt.desktop.cleanupError = String(error); receipt.result = 'failed'; process.exitCode = 1;
       }
     }
+    if (desktop.exitCode === null && desktop.signalCode === null) {
+      receipt.desktop.killRequestedAt = new Date().toISOString(); desktop.kill();
+    }
     await desktopClosed;
   }
   await fs.writeFile(path.join(evidence, 'receipt.json'), JSON.stringify(receipt, null, 2));

vendor/codewhale-ratatui/Cargo.lock

@@ -100,8 +100,9 @@ dependencies = [
 
 [[package]]
 name = "codewhale-app-server-protocol"
-version = "0.10.2"
+version = "0.10.3"
 dependencies = [
+ "chrono",
  "serde",
  "serde_json",
 ]
@@ -110,8 +111,8 @@ dependencies = [
 name = "codewhale-protocol"
 version = "0.10.3"
 dependencies = [
- "codewhale-app-server-protocol",
  "chrono",
+ "codewhale-app-server-protocol",
  "serde",
  "serde_json",
  "uuid",