ci: fail when committed dist is stale

[VickyXAI]

Why

Both consumers install this package straight from a commit tarball:

"@blockrun/router-core": "https://codeload.github.com/BlockRunAI/router-core/tar.gz/6a790eb..."

A tarball dependency runs no build step, and there is no prepare script — so ClawRouter and Franklin execute the dist/ that is committed to this repo.

npm run check (typecheck && test && build) rebuilds dist/, but nothing asserts the rebuild matches what is checked in. A PR that edits a .ts without rebuilding passes CI green and silently ships a stale artifact to every pinned consumer. Source and shipped behavior can diverge with no signal.

dist/ is in sync as of 6a790eb — this adds the guard before that stops being true by accident.

What

One step after npm run check, so the rebuild has already run:

- name: Verify committed dist matches source
  if: matrix.node == 20
  run: git diff --exit-code -- dist

Gated to a single matrix leg — the build output does not vary by Node major, so running it twice only doubles the noise on failure.

Verification

• Clean tree: npm run check then the guard → passes.
• Drift simulated (appended an export to tool-intent.ts, left dist/ untouched): after npm run check rebuilds, git diff --exit-code -- dist exits non-zero → CI fails, as intended.
• Ordering confirmed to matter: run standalone without the preceding build, the guard passes. Placing it after npm run check is load-bearing, hence the comment in the workflow.