huskies: merge 1242 refactor script/release builds project images so they can't drift

script/release

@@ -1,16 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# NOTE (story 1231): this script publishes the `huskies` binary artifact
-# (consumed by the `upgrade`/`upgrade all` chat commands) but does NOT
-# rebuild the huskies-project-* Docker images that `project-rebuild` uses.
-# Those images bake whatever binary was locally built the last time
-# `script/build-project-images` ran, so they silently drift stale otherwise
-# (currently baking 0.13.0). Run `script/build-project-images` after this
-# script — or better, fold it into this release flow — so a `project-rebuild`
-# right after a release doesn't need to self-heal a stale sled back up to the
-# version just published here.
-
 # ── Configuration ──────────────────────────────────────────────
 GITEA_URL="https://code.crashlabs.io"
 REPO="crashlabs/huskies"
@@ -97,6 +87,19 @@ cross build --release --target x86_64-unknown-linux-musl
 echo "==> Building Linux arm64 (static musl via cross)..."
 cross build --release --target aarch64-unknown-linux-musl
 
+# ── Build project images ─────────────────────────────────────────
+# Rebuild the huskies-project-* Docker images from this exact source tree
+# (the version-bump commit above already landed, so build.rs's `git
+# rev-parse HEAD` embeds the matching git hash) so they never drift from
+# the binary being published below. A release that can't produce these
+# images fails loudly here, before anything is tagged, pushed, or published.
+echo "==> Building project images..."
+if ! "${SCRIPT_DIR}/script/build-project-images"; then
+  echo "Error: failed to build huskies-project-* images at ${VERSION}."
+  echo "Release aborted — nothing was tagged, pushed, or published."
+  exit 1
+fi
+
 # ── Package ────────────────────────────────────────────────────
 DIST="target/dist"
 rm -rf "$DIST"