[WP02 · SubStep 02.04] Stamp version axes and compiled build identity

[deku2026]

DesktopPlatform artifacts currently expose partial source/version information, so a support report cannot distinguish package releases, native ABI compatibility and the exact producer execution. This implements the DesktopPlatform producer portion of the accepted WP02.04 profile (Design PR #52).

All ten NuGets gain an independently verified nine-axis report. Build.Policy stamps every owned managed assembly with source SHA, run/attempt, pipeline URL and source timestamp; package and assembly versions use the same allocated release. Native CMake and Visual Studio builds add the same identity to the existing build-info exports without changing ABI signatures or buffer/error semantics. Future schema/capability axes remain explicitly not produced.

Validation completed locally:

• Locked restore, managed build and Windows IDE/native build: zero warnings/errors; six architecture tests and real P/Invoke test passed.
• Both CMake profiles and all four native tests passed using existing vcpkg dependencies, without installing/rebuilding those dependencies. Local CMake 4.4.3/Ninja 1.13.2 results are development evidence; admitted CI keeps its existing exact tools/provenance.
• Four actual native DLL identity probes passed; the isolated Build.Policy NuGet consumer ran and rejected AFP002–AFP006 negative cases.
• 68 existing/new eng tests passed, then the strengthened six build-identity tests passed; 41 provenance/tooling tests, source inventory, managed formatting and clang-format hooks passed.
• Complete diff reviewed; corrected mutable dependency input aliasing, Windows timestamp escaping and JSON package content-type registration.

Required before merge: full PR CI, including the original ten-package candidate, tampered inner-report rejection, isolated Windows/Linux consumers, and actual JIT/Native AOT/C17 native package consumers. Required after merge: main publication, public NuGet verification and public package-only consumers. Consumer repositories must not update their Build.Policy pins before those producer gates complete. This PR does not close the other eight owners or all of WP02.04.

[deku2026]

Reviewed the complete implementation diff at 8453c33 against the accepted WP02.04 profile, including build-target ordering, native ABI buffer/error compatibility, immutable producer-attempt handling, package/source verification, test expectations and first-party provenance.

Findings fixed: mutable dependency inputs could mutate an existing report; Windows Exec timestamp formatting and MSBuild item expansion could yield epoch 0; JSON archive content types needed registration; the six changed CMake project blobs needed explicit reconciliation records rather than altering historical baselines. Their actual records now bind the merged Design authority. Related negative tests remain enforced.

Observed local evidence: managed and independent IDE/native builds, actual PE metadata checks, both CMake profiles/four native tests, four native runtime identity probes, package-only Build.Policy execution/negative cases, source/provenance and formatting checks. Full nine-owner inventory reconciliation now passes. Simulated CI metadata inputs were also checked locally and are only a mechanism test, not GitHub publication evidence.

No outstanding review finding in this diff. Merge remains conditional on all latest-head CI checks, including original candidate packaging and actual isolated JIT/Native AOT/C17 consumers. Public registry and merged-main verification remain required after merge.