#2360 — Ship Hook Bundles: Before / After

Why every Agent(isolation:"worktree") spawn broke in ork 8.30.0–8.32.0, and the three guardrails this PR adds.

Before (the incident path)

PR #2336 fixes worktree-provisioner in src/hooks/src/
↓
esbuild stamps // Generated: <timestamp> → every rebuild dirties ALL bundlesnoise
↓
plugins/ork/hooks/dist/*.mjs is gitignored → remote installs ship NO bundles; local installs copy whatever stale dist is on diskroot cause
↓
Sibling same-day PR rebuilds plugins/ from a tree WITHOUT the fix → last-write-wins on maincross-PR staleness
↓
build-plugins.sh: hooks esbuild failure → warn + continue → still prints “BUILD COMPLETE”silent-stale
↓
Shipped lifecycle.mjs lacks the provisioner → hook exits 0 with empty stdout → every worktree-isolated agent spawn aborts (8.30.0–8.32.0)

After (this PR)

PR merges hook source change
↓
No timestamps in banners or bundle-stats.json → identical source = byte-identical distdeterministic
↓
plugins/ork/hooks/dist/ is tracked in git → marketplace installs always get the built bundlesshipped
↓
CI drift gate diffs plugins/ AND src/hooks/dist/ after a fresh rebuild — on PRs and on push: maingated
↓
build-plugins.sh hard-fails (exit 1, no “BUILD COMPLETE”) when the hooks esbuild step fails or dist is absentloud
↓
Stale bundle can no longer reach a release: it either fails the build or fails the drift gate

Dev edits a hook, forgets cd src/hooks && npm run build.

Before: rsync copies the stale dist into plugins/; gitignore hides it; PR merges green; users run old code.
After: CI installs hook deps, rebuilds from source, then diffs the tracked src/hooks/dist/ + plugins/ork/hooks/dist/ — the stale committed copy differs from the fresh build and the drift gate fails the PR.

Two same-day PRs; the second rebuilds plugins/ from a tree without the first PR's hook fix.

Before: per-PR self-consistency passes both; last-write-wins erases the fix on main; nothing re-checks main.
After: the drift gate also runs on push to main — the post-merge rebuild diverges from the committed bundles and main goes red immediately instead of shipping a broken release.

The hooks esbuild step errors during npm run build.

Before: warn-and-continue; script prints “BUILD COMPLETE”; stale bundles ship.
After: the build aborts with exit 1 and an explicit error; if node_modules is missing AND no committed dist exists, it also aborts instead of assembling an empty hooks payload.

Guardrail	File	Failure mode it kills
Deterministic bundles	`src/hooks/esbuild.config.mjs`	Timestamp churn masking real bundle diffs
Tracked dist	`.gitignore`	Marketplace installs shipping no/stale bundles
Hard-fail build	`scripts/build-plugins.sh`	“BUILD COMPLETE” after a failed esbuild
Extended drift gate	`.github/workflows/ci.yml`, `prerelease.yml`	Cross-PR staleness reaching a release

Issue #2360 — shipping hook bundles, before / after

Before (the incident path)

After (this PR)