Make release-artifacts dirty assertion track real git state

test_release_script_generates_checksummed_artifacts hard-coded
`dirty == 1`, which only held while the worktree happened to be dirty. The
script derives `dirty` from actual git state and RELEASE_ALLOW_DIRTY is a
permission flag, not a forced value — so the test failed the moment the tree
was clean (all work committed). Compute the expected dirty flag the same way
the script does so the test is deterministic on both clean and dirty trees.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_packaging.py

@@ -66,6 +66,21 @@ class TestArchPackaging(unittest.TestCase):
         self.assertIn("--cleanbuild", script)
 
 
+def _git_worktree_dirty() -> int:
+    """Mirror the dirty computation in release-artifacts.sh so the assertion
+    holds whether the tree is clean (work committed) or dirty (mid-change)."""
+    def q(*args: str) -> subprocess.CompletedProcess:
+        return subprocess.run(["git", *args], cwd=ROOT,
+                              capture_output=True, text=True)
+    if q("diff", "--quiet").returncode != 0:
+        return 1
+    if q("diff", "--cached", "--quiet").returncode != 0:
+        return 1
+    if q("ls-files", "--others", "--exclude-standard").stdout.strip():
+        return 1
+    return 0
+
+
 class TestReleaseArtifacts(unittest.TestCase):
     def test_release_script_generates_checksummed_artifacts(self):
         with tempfile.TemporaryDirectory() as d:
@@ -99,7 +114,7 @@ class TestReleaseArtifacts(unittest.TestCase):
             data = json.loads(manifest.read_text())
             self.assertEqual(data["project"], "enodia-sentinel")
             self.assertEqual(data["version"], version)
-            self.assertEqual(data["dirty"], 1)
+            self.assertEqual(data["dirty"], _git_worktree_dirty())
             self.assertIn(archive.name, data["artifacts"])
             self.assertIn("SHA256SUMS", data["artifacts"])