feat(manifest): declare the minimal runtime_bundle path set

CHANGELOG.md

@@ -13,6 +13,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   general-availability download and Ubuntu is NDDev-supported on top of the
   vendor Linux beta channel, each with an explicit verified/expiry freshness
   window.
+- A tracked `build/release-evidence.json` bundle binding a release to the
+  validated harness commit and a content digest of the exact module setup; the
+  release workflow refuses to publish without a present, consistent bundle.
+- A declared minimal `runtime_bundle` path set in `build/manifest.json`: the
+  install-required tracked paths (installer, catalogs, build and runtime
+  metadata, license) excluding governance, CI, and source-level documentation.
 
 ## [2.1.2] - 2026-07-10
 

build/manifest.json

@@ -12,6 +12,20 @@
     "docs/": "public installation, architecture, and secrets documentation",
     ".github/": "public security, release, and repository-automation workflows"
   },
+  "runtime_bundle": {
+    "_comment": "Minimal runtime distribution closure: the tracked paths required to install ZCode from a selected setup, excluding governance, CI, and source-level documentation. A release may publish this as a second, attested bundle distinct from the full source archive.",
+    "paths": [
+      "VERSION",
+      "LICENSE",
+      "NOTICE",
+      "README.md",
+      "build",
+      "cli-tools",
+      "config",
+      "references",
+      "zcode_tools"
+    ]
+  },
   "artifact_integrity_policy": {
     "metadata_source": "build/version.json:zcode_download_artifacts",
     "canonical_cdn_base": "https://cdn-zcode.z.ai/zcode/electron/releases",

build/release-evidence.json

@@ -2,11 +2,11 @@
   "schema_version": 1,
   "module": {
     "repository": "NDDev-it-com/nddev-zcode-app",
-    "setup_digest": "sha256:a37371e22ca4b4bb711cb5e59a1b017382d5034856c100ed7d273f8c0fcf4a7b"
+    "setup_digest": "sha256:a4338b65f702404e0e2e9b91314063a980f0c803d0d84961839f12c656a2778b"
   },
   "harness": {
     "repository": "NDDev-it-com/nddev-harnesses",
-    "commit": "7d9239d673eaebbbd172a1bb7d906eee82d730e2"
+    "commit": "26f540414bbe6d4e7d0f9776057cac9e4c9d699f"
   },
   "adapter": {
     "id": "zcode",
@@ -37,8 +37,8 @@
     "benchmark:macos",
     "benchmark:ubuntu"
   ],
-  "generated_at_utc": "2026-07-11T18:04:36Z",
-  "expires_at_utc": "2027-01-07T18:04:36Z",
+  "generated_at_utc": "2026-07-11T18:32:54Z",
+  "expires_at_utc": "2027-01-07T18:32:54Z",
   "promotion": {
     "decision": "approved"
   }