Require git provenance for Android Argus staging

Android/scripts/prepare-argus-publication.ps1

@@ -10,7 +10,8 @@ param(
     [string]$RepositoryUrl = 'https://git.kusoft.xyz/sevenhill/QSfera.git',
     [string]$HomepageUrl = 'https://qsfera.kusoft.xyz',
     [switch]$Unlisted,
-    [switch]$SkipSigningInitialization
+    [switch]$SkipSigningInitialization,
+    [switch]$SkipGitProvenanceCheck
 )
 
 $ErrorActionPreference = 'Stop'
@@ -112,9 +113,70 @@ function Find-FirstTool([string]$AndroidHome, [string]$ToolName) {
     return $tool.FullName
 }
 
+function Invoke-Git([string[]]$Arguments) {
+    $output = & git @Arguments 2>&1
+    if ($LASTEXITCODE -ne 0) {
+        throw "git $($Arguments -join ' ') failed with exit code $LASTEXITCODE. Output: $($output | Out-String)"
+    }
+    return @($output)
+}
+
+function Assert-GitReleaseProvenance {
+    if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
+        throw 'git was not found. Argus publication requires git provenance verification.'
+    }
+
+    $insideWorkTree = (Invoke-Git @('rev-parse', '--is-inside-work-tree') | Select-Object -First 1).Trim()
+    if ($insideWorkTree -ne 'true') {
+        throw 'Argus publication must be prepared from inside a git work tree.'
+    }
+
+    $status = Invoke-Git @('status', '--porcelain')
+    if ($status.Count -gt 0) {
+        throw "Git work tree has uncommitted changes. Commit or stash all changes before preparing Argus publication."
+    }
+
+    $branch = (Invoke-Git @('rev-parse', '--abbrev-ref', 'HEAD') | Select-Object -First 1).Trim()
+    if ($branch -eq 'HEAD') {
+        throw 'Git HEAD is detached. Check out the release branch before preparing Argus publication.'
+    }
+
+    try {
+        $upstream = (Invoke-Git @('rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}') | Select-Object -First 1).Trim()
+    } catch {
+        throw "Git branch has no upstream. Push $branch and set its upstream before Argus publication."
+    }
+
+    Invoke-Git @('fetch', '--quiet')
+
+    $aheadBehind = (Invoke-Git @('rev-list', '--left-right', '--count', 'HEAD...@{u}') | Select-Object -First 1).Trim() -split '\s+'
+    $ahead = [int]$aheadBehind[0]
+    $behind = [int]$aheadBehind[1]
+    if ($ahead -ne 0 -or $behind -ne 0) {
+        throw "Git HEAD must match upstream before Argus publication. Branch $branch tracks $upstream, ahead=$ahead, behind=$behind."
+    }
+
+    return [ordered]@{
+        branch = $branch
+        upstream = $upstream
+        commit = (Invoke-Git @('rev-parse', 'HEAD') | Select-Object -First 1).Trim()
+        verifiedAt = [DateTimeOffset]::UtcNow.ToString('O')
+    }
+}
+
 $repoRoot = Split-Path -Parent $PSScriptRoot
 Set-Location $repoRoot
 
+$gitProvenance = if ($SkipGitProvenanceCheck) {
+    [ordered]@{
+        skipped = $true
+        reason = 'SkipGitProvenanceCheck was set'
+        verifiedAt = [DateTimeOffset]::UtcNow.ToString('O')
+    }
+} else {
+    Assert-GitReleaseProvenance
+}
+
 $javaHome = Resolve-JavaHome
 $androidHome = Resolve-AndroidHome
 $env:JAVA_HOME = $javaHome
@@ -251,6 +313,7 @@ $metadata = [ordered]@{
     notes = if ($Notes) { $Notes } else { $null }
     repositoryUrl = if ($RepositoryUrl) { $RepositoryUrl } else { $null }
     homepageUrl = if ($HomepageUrl) { $HomepageUrl } else { $null }
+    git = $gitProvenance
     androidPackageName = $packageName
     androidVersionCode = [int]$versionCode
     targetSdkVersion = [int]$targetSdk