chore(release): refresh Linux archive and npm bootstrap pin

docs/internal/WINDOWS_BUNDLED_GIT_CANDIDATE.md

@@ -10,6 +10,8 @@ Workbench now asks for explicit name/email in a separate native modal only when
 
 Next Windows setup identity: 0.15.0-rc.2-windows.2, numeric resource 0.15.0.4. The shared dialog also applies to Linux: DEB/tar payloads need rebuilding to include it, with the existing system-Git prerequisite unchanged. The npm bootstrap must be repinned and retested against any rebuilt Linux archive before use; no publication is authorized.
 
+Aaron authorized completing the Linux rebuild and npm repin/package work (Discord 1557866988989325453). The Linux DEB and portable archive were rebuilt from clean merged `7b97db1fb2c4490cabc0d606a0cf55585390c4bb`, after its exact merged-main CI passed. Fresh archive launch and actual DEB install/API/WebSocket/quit/remove passed in disposable environments; this is technical proof, not graphical/operator acceptance. The tar.gz SHA256 is `aab167c13ab20ca98dd721b56a8f5d34f394913969512f1fcbca84bff7b3b9d7`; the DEB SHA256 is `6464654464fc82eef9d2dbcec1e7217c193b64a367520f787227931c34e8b5ad`. The npm repin is in progress under its own source-first PR/CI/merge gate; package and test its clean merged source against these unchanged archive bytes. No recursive app rebuild is required for this bootstrap-only change. Private transfer only; Windows operator acceptance remains pending independently, and TEST45495 remains untouched.
+
 Pin: official PortableGit-2.56.0.2-64-bit.7z.exe, release v2.56.0.windows.2, 60027568 bytes, SHA256 075e158ef8e1f0ab80b347e245405d3eca735c2dc88fd8e032e137d0ca61f61b. Preserve full licenses/package inventory. Run upstream post-install on the target, not the build machine (it copies host networking files). Git PATH applies only to World and inherited children; preserve user configuration.
 
 Icon: preserve the exact source SVG. Rasterize its intrinsic 1024px composition once, then uniformly downsample it into ICO sizes so non-scaling-stroke does not inflate strokes at 16–256px. Use a new installed icon filename to avoid reusing the old shortcut icon cache key.

tooling/release/npm-installer/README.md

@@ -18,4 +18,16 @@ Local candidate verification without publication:
 AIW_TEST_ARCHIVE=/path/to/AgentIntersect-World-0.15.0-rc.2-linux-x64.tar.gz node --test tooling/release/npm-installer/test/install.test.mjs
 ```
 
-The test uses `--archive` solely to supply the **same exact pinned archive** locally; it still checks the checksum. Before publication, confirm the hosted asset bytes equal the embedded digest and run a clean npm tarball install smoke. A changed archive needs a new package version/digest. The npm package is a bootstrapper, not the application payload.
+The test uses `--archive` solely to supply the **same exact pinned archive** locally; it still checks the checksum. This unpublished candidate pairs with the clean application source `7b97db1fb2c4490cabc0d606a0cf55585390c4bb` archive, SHA-256 `aab167c13ab20ca98dd721b56a8f5d34f394913969512f1fcbca84bff7b3b9d7`. Application and bootstrap source commits are recorded separately in the private kit. Do not mix older rc.2 archive or npm tarball bytes with this pair.
+
+For private transfer, use the exact local npm tarball and app archive from the same checksum-verified kit:
+
+```sh
+npx --yes --package=/absolute/path/agentintersect-world-installer-0.15.0-rc.2.tgz agentintersect-world-install install --archive /absolute/path/AgentIntersect-World-0.15.0-rc.2-linux-x64.tar.gz
+# or
+pnpm dlx /absolute/path/agentintersect-world-installer-0.15.0-rc.2.tgz install --archive /absolute/path/AgentIntersect-World-0.15.0-rc.2-linux-x64.tar.gz
+```
+
+This installer does not replace an already-installed `0.15.0-rc.2` directory. Test in a fresh home or separate `XDG_DATA_HOME` and `XDG_BIN_HOME`; an "already installed" message is not an upgrade to new candidate bytes. Keep application state separate and preserve existing projects/state. A repeat-install test only proves idempotence for the same installed candidate.
+
+Before publication, confirm the hosted asset bytes equal the embedded digest and run a clean public-registry install smoke. After publication, a changed archive requires a new immutable package version/digest; this candidate remains unpublished. Local tarball tests do not prove the registry or hosted-download path. The npm package is a bootstrapper, not the application payload.

tooling/release/npm-installer/install.mjs

@@ -19,7 +19,7 @@ import { pipeline } from "node:stream/promises";
 const version = "0.15.0-rc.2";
 const name = `AgentIntersect-World-${version}-linux-x64`;
 const sha256 =
-  "22dc7f007efc7af9354aa4dab0f1397d2a353e4062a6e539fd80db1b9cb05704";
+  "aab167c13ab20ca98dd721b56a8f5d34f394913969512f1fcbca84bff7b3b9d7";
 const url = `https://github.com/MelaBuilt-AI/AgentIntersect-World/releases/download/v${version}/${name}.tar.gz`;
 
 async function exists(path) {

tooling/release/npm-installer/test/install.test.mjs

@@ -75,7 +75,7 @@ test(
       assert.equal(
         JSON.parse(readFileSync(join(installed, "BUILD.json"), "utf8"))
           .sourceCommit,
-        "9124c8e603364a6ca87480168c3fb31fc9cf9f83",
+        "7b97db1fb2c4490cabc0d606a0cf55585390c4bb",
       );
       const repeat = run();
       assert.equal(repeat.status, 0, repeat.stderr);