fix(distribution): canonical target-triplet table + verified/atomic installers

[wesleysimplicio]

Summary

Issue #5 is a large P0 distribution epic. This PR lands a real, self-contained slice: it fixes the concrete naming drift that was breaking the Windows installer today, and turns that class of bug into a CI-enforced invariant.

Bug found and fixed: install.ps1 downloaded simplicio-windows-x64 while .github/workflows/release.yml staged simplicio-windows-x86_64.exe — no release asset ever matched what the installer requested, so irm .../install.ps1 | iex on Windows was broken. install.sh had the same problem for macOS/Linux: it built asset names from darwin/x86_64, but the workflow only ever published macos-arm64/darwin-x64/linux-x64.

What changed

• distribution/targets.json — the canonical target-triplet table (AC: "tabela canônica de target triplets") — os/arch/rust-triple/asset-name for windows-x64, macos-arm64, macos-x64, linux-x64. release.yml, install.sh, install.ps1 and simplicio-update-manifest.json all now derive their naming from this table instead of each inventing its own convention.
• .github/workflows/release.yml — stages assets under the canonical names.
• simplicio-update-manifest.json — adds real SHA256 entries (computed from the already-committed SHA256SUMS, not fabricated) for windows-x64, macos-x64, linux-x64. Each is explicitly "signed": false with a signing_note — no fake signatures are claimed; macos-arm64 keeps its existing real ed25519 signature untouched.
• install.ps1 / install.sh — download to a staging file, verify SHA256 against the manifest before installing (refuses by default if no checksum is published for the target; SIMPLICIO_ALLOW_UNVERIFIED=1 to override), then atomically move the verified file into place. Added idempotent -Doctor/--doctor (binary present, on PATH, runs) and -Uninstall/--uninstall (removes the binary only, preserves ~/.simplicio user data) subcommands — safe to re-run any number of times.
• scripts/verify_distribution_consistency.py — new check_target_triplet_consistency check: fails CI if release.yml, either installer, or the manifest drifts from distribution/targets.json, so this exact bug class can't silently regress.
• INSTALL.md — corrected the manual-download asset table (it previously listed the wrong/generic filenames) and documented the new doctor/uninstall flags.

Explicitly out of scope for this PR (tracked under issue #5 for follow-up)

• ed25519 signing for windows-x64, macos-x64, linux-x64 (only macos-arm64 is currently signed — no signing key/infra available to generate real signatures here).
• Local LLM provisioning flow (verified/licensable).
• Auto-update + rollback with a running process.
• Full Homebrew/npm/pypi wrapper version alignment (scripts/verify_distribution_consistency.py already flags these as pre-existing WARNs — Formula is on 1.2.0, npm/pypi on 3.0.2, manifest on 3.5.2, and version.txt on 3.0.2 vs manifest 3.5.2; none of that is touched here since it requires an actual release decision, not a script change).
• Clean-Windows-VM install/update/uninstall verification pass with screenshots (needs a real VM, not available in this environment).

Test plan

• python scripts/verify_distribution_consistency.py — new target-triplet check passes ([OK] release.yml, installers and manifest all agree with distribution/targets.json (4 targets)); pre-existing unrelated version.txt vs manifest ERROR is unchanged from before this PR (verified via git stash).
• install.ps1 parses cleanly ([System.Management.Automation.Language.Parser]::ParseFile, no errors).
• install.sh passes bash -n; --doctor code path exercised with a mocked uname (correctly reports missing binary / PATH status / exit code).
• SHA256 values added to the manifest were computed directly from the committed binaries and cross-checked against the existing SHA256SUMS file (simplicio-windows-x64.exe, simplicio-darwin-x64, simplicio-linux-x64) — not fabricated.
• Real end-to-end install on a clean Windows/macOS/Linux VM (needs an actual release + VM; not exercised here).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac272bf8c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the macOS arm checksum before enforcing verification

With this commit the Unix installer now rejects checksum mismatches, but the macOS-arm artifact still carries a stale hash/signature. I checked the release workflow: it stages the repository's simplicio file as dist/simplicio-macos-arm64 (.github/workflows/release.yml line 39), and the current file hashes to 1911069c..., not the manifest's 931bc6d...; once this workflow publishes that asset, Apple Silicon installs fail at the new checksum check. Please update the manifest/signature to match the staged asset or stage the signed binary.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Avoid requiring python3 just to parse the manifest

On fresh macOS/Linux installs where curl/wget and shasum are available but python3 is not, this branch silently skips parsing the successfully downloaded manifest, leaves EXPECTED_SHA256 empty, and the next block refuses the install as if no checksum were published. That makes Python an undocumented hard prerequisite before the binary can even be installed; use an available parser/fallback or fail with an explicit dependency error instead of reporting missing checksums.

Useful? React with 👍 / 👎.