Print the Microsoft submission obligation into the release summary

[TheAbider]

Why

Antivirus false-positive clearances are granted per hash. Microsoft cleared v1.122.4 on
2026-08-12 — that covers exactly 658edcc5… and nothing else, so every future release starts over
with the ML models regardless of how small the change is.

That obligation was sitting in a checklist. So was the last one, right before it got missed.

What

The release job prints it into the run summary — new SHA-256, portal link, and the priority
caveat (the portal's hidden default is Low, whose own label says submissions "may never be
processed by an analyst"). It surfaces where the release is already being validated rather than
depending on anyone's memory.

winget manifests for 1.122.4. The July submission was withdrawn because CI retention deleted
the previous release and killed the manifest's InstallerUrl between versions. That step was
removed in #95, so URLs stay alive now. winget validate passes and the installer URL returns 200.

Tests

Section 209 gains 5 assertions: the step exists, links the portal, publishes the hash, writes to the
summary, and carries the same version-bump gate as the build steps around it.

An encoding trap, caught by the tests disagreeing with themselves

The new assertions passed under pwsh and failed under powershell.exe. Cause: ci.yml has no
BOM, and Windows PowerShell 5.1 decodes BOM-less files as ANSI, so its em-dashes arrive as
mojibake while pwsh 7 reads them as UTF-8. The suite runs both ways — directly under pwsh, and
under powershell.exe from local/Validate-Release.ps1 — so any assertion matching non-ASCII text
in that file is host-dependent.

Fixed at both levels: Section 209 now reads ci.yml with -Encoding UTF8 explicitly (fixes the
class of bug for every assertion against that file) and anchors only on ASCII (belt and braces).
Verified identical results under both hosts.

Worth knowing generally: this workflow is full of em-dashes and box-drawing characters, so the same
trap is waiting for any future assertion that matches them.

Structural tests 5485 → 5493. Full gate: 42 passed / 0 failed / 0 warnings, suite 5493/5493 —
run through Validate-Release, i.e. the Windows PowerShell 5.1 path that was failing.

On merge

No version bump — this does not cut a release.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!