projection: bind the repaired release source

The final projection state matches the source-owned release and public-surface policy.

Source-Sha: c1a84422a30a1dcf4ac9880a979de8fc6d4cb6c1
Policy-Sha: c1a84422a30a1dcf4ac9880a979de8fc6d4cb6c1
Tree-Digest: 13c2b0b731c29662c4909f73fc7246e8a0592c7e914fb8724d74594e38bebd69

.gitea/workflows/release.yml

@@ -299,7 +299,12 @@ jobs:
 
       - name: Install cargo-zigbuild
         if: matrix.use_zigbuild
-        run: pip3 install --break-system-packages cargo-zigbuild
+        run: |
+          pip_args=()
+          if pip3 install --help | grep -q -- '--break-system-packages'; then
+            pip_args+=(--break-system-packages)
+          fi
+          pip3 install "${pip_args[@]}" cargo-zigbuild
 
       - name: Download web UI
         uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3

.publication/paths.txt

@@ -59,17 +59,6 @@ RAF/verification/03-key-rotation.md
 RAF/verification/04-replay-protection.md
 README.md
 SECURITY.md
-Screenshots/7Zip-Updates-RedFlag-Dependency.png
-Screenshots/RedFlag Agent List.png
-Screenshots/RedFlag Default Dashboard.png
-Screenshots/RedFlag Docker Dashboard.png
-Screenshots/RedFlag Heartbeat System.png
-Screenshots/RedFlag History Dashboard.png
-Screenshots/RedFlag Linux Agent Details.png
-Screenshots/RedFlag Live Operations - Failed Dashboard.png
-Screenshots/RedFlag Updates Dashboard.png
-Screenshots/RedFlag Windows Agent Details.png
-Screenshots/Upstream-Version-Tracking.png
 THIRD_PARTY_LICENSES.md
 agent/NOTICE
 agent/cmd/agent/cli.go

.publication/surface.json

@@ -7,35 +7,9 @@
     ".publication/evidence/github-break-glass-2026-09-04.json",
     "RAF/components/06-session-broker.md",
     "RAF/flows/03-agent-upgrade.md",
-    "Screenshots/AgentMgmt.png",
-    "Screenshots/Lore Testing.png",
-    "Screenshots/Overview.png",
-    "Screenshots/RedFlag Agent Dashboard.png",
-    "Screenshots/RedFlag Linux Agent Health Details.png",
-    "Screenshots/RedFlag Linux Agent History Extended.png",
-    "Screenshots/RedFlag Linux Agent Update Details.png",
-    "Screenshots/RedFlag Registration Tokens.jpg",
-    "Screenshots/RedFlag Settings Page.jpg",
-    "Screenshots/RedFlag Windows Agent History .png",
-    "Screenshots/RedFlag Windows Agent History Extended.png",
-    "Screenshots/RedFlagIntro.jpg",
-    "Screenshots/Screenshot 2026-05-31 at 10-24-24 RedFlag Dashboard.png",
-    "Screenshots/Screenshot 2026-05-31 at 12-13-09 RedFlag Dashboard.png",
-    "Screenshots/Screenshot 2026-05-31 at 20-49-57 RedFlag Dashboard.png",
     "scripts/generate-keypair.go"
   ],
   "review_required": [
-    "Screenshots/7Zip-Updates-RedFlag-Dependency.png",
-    "Screenshots/RedFlag Default Dashboard.png",
-    "Screenshots/RedFlag Docker Dashboard.png",
-    "Screenshots/RedFlag Heartbeat System.png",
-    "Screenshots/RedFlag History Dashboard.png",
-    "Screenshots/RedFlag Linux Agent Details.png",
-    "Screenshots/RedFlag Live Operations - Failed Dashboard.png",
-    "Screenshots/RedFlag Agent List.png",
-    "Screenshots/RedFlag Updates Dashboard.png",
-    "Screenshots/Upstream-Version-Tracking.png",
-    "Screenshots/RedFlag Windows Agent Details.png",
     "RAF/README.md",
     "RAF/components/04-helper.md",
     "RAF/components/05-desktop.md",

CHANGELOG.md

@@ -10,6 +10,14 @@ Format: version, date, then grouped by category (Added, Changed, Removed, Fixed,
 
 ---
 
+## v0.2.9.7 (September 2026)
+
+### Fixed
+- Release builds now use one pinned MSI compiler from the source tree and
+  install the introspection headers it requires.
+- Darwin release jobs install cargo-zigbuild across both externally managed
+  and conventional Python environments.
+
 ## v0.2.9.6 (September 2026)
 
 ### Fixed

README.md

@@ -38,19 +38,19 @@ What makes RedFlag different: the software that patches your fleet runs as root
 
 ---
 
-| ![Dashboard](Screenshots/RedFlag%20Default%20Dashboard.png) | ![Agent Health](Screenshots/RedFlag%20Linux%20Agent%20Details.png) | ![Dependency Resolution](Screenshots/7Zip-Updates-RedFlag-Dependency.png) |
+| ![Dashboard](https://samaritansolutions.net/images/redflag/screenshots/redflag-default-dashboard.png) | ![Agent Health](https://samaritansolutions.net/images/redflag/screenshots/redflag-linux-agent-details.png) | ![Dependency Resolution](https://samaritansolutions.net/images/redflag/screenshots/7zip-updates-redflag-dependency.png) |
 |---|---|---|
 
 <details>
 <summary>More screenshots</summary>
 
-| ![Live Ops](Screenshots/RedFlag%20Live%20Operations%20-%20Failed%20Dashboard.png) | ![History](Screenshots/RedFlag%20History%20Dashboard.png) | ![Docker](Screenshots/RedFlag%20Docker%20Dashboard.png) |
+| ![Live Ops](https://samaritansolutions.net/images/redflag/screenshots/redflag-live-operations-failed-dashboard.png) | ![History](https://samaritansolutions.net/images/redflag/screenshots/redflag-history-dashboard.png) | ![Docker](https://samaritansolutions.net/images/redflag/screenshots/redflag-docker-dashboard.png) |
 |---|---|---|
 
-| ![Heartbeat](Screenshots/RedFlag%20Heartbeat%20System.png) | ![Windows Agent](Screenshots/RedFlag%20Windows%20Agent%20Details.png) | ![Agent List](Screenshots/RedFlag%20Agent%20List.png) |
+| ![Heartbeat](https://samaritansolutions.net/images/redflag/screenshots/redflag-heartbeat-system.png) | ![Windows Agent](https://samaritansolutions.net/images/redflag/screenshots/redflag-windows-agent-details.png) | ![Agent List](https://samaritansolutions.net/images/redflag/screenshots/redflag-agent-list.png) |
 |---|---|---|
 
-| ![Upstream Tracking](Screenshots/Upstream-Version-Tracking.png) | ![Updates](Screenshots/RedFlag%20Updates%20Dashboard.png) | |
+| ![Upstream Tracking](https://samaritansolutions.net/images/redflag/screenshots/upstream-version-tracking.png) | ![Updates](https://samaritansolutions.net/images/redflag/screenshots/redflag-updates-dashboard.png) | |
 |---|---|---|
 
 </details>
@@ -101,12 +101,6 @@ curl -sfL -H "X-Registration-Token: your-token" "https://your-server.com/api/v1/
 ```
 
 **Windows:**
-
-Run elevated Windows PowerShell with an operator-installed OpenSSL 3 executable
-on `PATH` (`Get-Command openssl`). The installer checks Ed25519 acceptance and
-rejection before changing the agent. Missing verification support, unsigned or
-invalid signatures, and manifest hash mismatches stop installation. Installing
-PowerShell 7 alone does not supply this verifier.
 ```powershell
 iwr -Headers @{"X-Registration-Token"="your-token"} "https://your-server.com/api/v1/install/windows" | iex
 ```

docker-compose.yml

@@ -21,7 +21,7 @@ services:
       context: .
       dockerfile: ./server/Dockerfile
       args:
-        BUILD_VERSION: ${BUILD_VERSION:-0.2.9.6}
+        BUILD_VERSION: ${BUILD_VERSION:-0.2.9.7}
     container_name: redflag-server
     volumes:
       - server-config:/app/config

installer/windows/provision-msitools.sh

@@ -9,8 +9,8 @@ WORK=$(mktemp -d)
 
 sudo apt-get update -qq
 sudo apt-get install -y -qq build-essential valac bison gettext ninja-build \
-    libglib2.0-dev libgsf-1-dev libgcab-dev libxml2-dev gobject-introspection \
+    libglib2.0-dev libgirepository1.0-dev libgsf-1-dev libgcab-dev \
-    python3-venv curl jq
+    libxml2-dev gobject-introspection python3-venv curl jq
 
 curl --fail --location --retry 3 \
     https://download.gnome.org/sources/msitools/0.106/msitools-0.106.tar.xz \

server/internal/version/versions.go

@@ -15,8 +15,8 @@ import (
 // tag — the release gate enforces this. ldflags may override at build time;
 // the release pipeline injects the tag so binaries and source agree.
 var (
-	AgentVersion    = "0.2.9.6"
+	AgentVersion    = "0.2.9.7"
-	ConfigVersion   = "0.2.9.6"
+	ConfigVersion   = "0.2.9.7"
 	MinAgentVersion = "0.1.22"
 )