feat(orchestrator): build reliability features — git integrity, reserved filenames, archival

[frostebite]

Summary

Three optional reliability features that harden the build pipeline for self-hosted runners and enterprise environments (#807).

Features

Feature	Input	Default	Purpose
Git Integrity Check	gitIntegrityCheck	false	Pre-checkout git fsck, stale lock cleanup, submodule backing store validation
Auto Recovery	gitAutoRecover	true	Automatically recover corrupted repos when integrity check fails
Reserved Filename Cleanup	cleanReservedFilenames	false	Remove Windows device names (nul, con, prn) from Assets/
Build Archival	buildArchiveEnabled	false	Post-build output archival with retention policy
Archive Path	buildArchivePath	''	Configurable archive location
Archive Retention	buildArchiveRetention	3	Builds to retain per platform

New Service

BuildReliabilityService at src/model/orchestrator/services/reliability/ with methods:

• cleanStaleLockFiles() — Remove stale git lock files from .git/
• cleanReservedFilenames() — Scan and remove Windows reserved device names from Assets/
• validateSubmoduleBackingStores() — Verify submodule .git files point to existing backing stores
• enforceRetention() — Post-build archival with configurable retention count
• configureGitEnvironment() — Set CI-friendly git environment variables (GIT_CONFIG_NOSYSTEM=1)

All features are opt-in and fail gracefully (warnings only, never blocks the build).

Test coverage

5 unit tests covering:

• Stale lock file cleanup (missing .git directory)
• Reserved filename cleanup (missing Assets directory)
• Submodule backing store validation (missing .gitmodules)
• Retention enforcement (missing archive path)
• Git environment configuration

Related

• Closes feat: Build Reliability Features — git integrity, reserved filename cleanup, and build output archival #807

Test plan

• Unit tests pass for all service methods
• Integration test with gitIntegrityCheck: true on a self-hosted runner
• Integration test with cleanReservedFilenames: true on a project with reserved names
• Integration test with buildArchiveEnabled: true to verify retention policy

Summary by CodeRabbit

• New Features

  • Added optional pre/post-build reliability controls: Git integrity checks with optional auto-recovery, Windows reserved filename cleanup, and configurable build output archiving with retention; new inputs expose these options.

• Tests

  • Added extensive unit tests covering the new reliability utilities, archiving, and retention behaviors.

• Chores

  • CI workflow: allow macOS build job to continue on error.

---

Tracking:

• LTS (v2.0.0) — #794
• Orchestrator: The Endgame — #810