feat: follow JoltPhysicsC releases, and check the natives against the imports

[jcant0n]

The headers and the ten native libraries were arriving by two unrelated routes, and nothing tied them together.

	before	after
Headers	ref: main — moving, no recorded SHA, no drift check	JoltPhysicsC tree at the tracked release tag
Libraries	downloaded from another repo's artifacts and committed by hand	the ten archives attached to that same release
Version	inferable only by chasing two repositories	release.current in the manifest

The hand-carry is visible in the timing: the JoltPhysicsC build finished at 12:24 and the commit "Add runtimes for android-arm…" landed at 12:31. Seven minutes.

Both halves now come from one release, resolved as track: stable. Same revision by construction, not by whoever remembers.

CD: simple → tracked

binding-simple-cd publishes unconditionally. That is why it had no cron — a schedule would ship a package every month whether or not the API moved. binding-tracked-cd reads the manifest and publishes only when the generated code changed, so it now runs monthly, with a resolve job in front that puts the version in the summary before anything is committed.

No natives-artifact-pattern: the libraries are not built here. They arrive through upstream.assets, which is also what satisfies the CD's refusal to commit a bump without them.

CI: the check that was missing

1,280 P/Invoke declarations against ten libraries nobody was comparing them to. P/Invoke binds late: a declaration naming a symbol the library does not export compiles, passes CI, packs, publishes, and throws the first time a consumer calls it.

It also reads each library's machine field and checks it against the architecture its RID promises. ImGui.Net shipped an osx-x64 dylib that was arm64 for months and no Intel Mac could load it.

The gate, without auto-merge

native-coherence: true, so the merge depends on it rather than watching it go red alongside.

auto-merge: false on purpose. Every other repository in the fleet earned it by running its pipeline a few times first, and this one has never published from a working generator — until today it wrote its output into a directory nobody read. Two clean cycles first.

Why the libraries stay committed

The fetch keeps them current and is idempotent when the release has not moved. And a pull request does not fetch, so removing them would leave the coherence check with nothing to check.

Also corrects package.runtime-identifier, which still said linux-x64 after generation moved to Windows, and adds the weekly toolbox-update.

🤖 Generated with Claude Code

[github-actions]

API gate: additive

Every symbol that existed still exists, unchanged. Nothing that compiled before stops compiling.

Target framework	Added	Removed
net10.0	+0	-0

_{Enum and constant values are part of the measured surface: a renumbering keeps compiling and sends the wrong number to the driver, so it counts as a removal.}