docs(architecture): audit CLI and distribution group against implementation

[ggbdpq]

Summary

Audits the CLI and distribution group (5 documents) from #3522 against the current implementation (22715e8). No drift found in any of the five; the four hand-maintained documents gain the standard frontmatter block with last_verified, while the generated inventory document is left byte-identical to its base revision.

• docs/cli-distribution.md — enforcement artifacts exist: scripts/product-release-identity.mjs (with the RELEASE.json identity fields such as sourceCommit), .github/workflows/release.yml, root DISCLAIMER-WIP. The bin/maka / libexec/** names are archive-layout outputs, as the document itself scopes them.
• docs/cli-npm-release.md + .zh-CN.md — every referenced workflow resolves (npm-publication.yml, desktop-nightly.yml, release-cli-stage.yml, release-cli-finalize.yml), and the pair stays in lockstep on the Trusted Publisher / OIDC staging / 2FA / Finalize provenance flow.
• docs/windows-support.md — the installer name matches scripts/desktop-release-targets.mjs (Maka-${version}-win-x64.exe); the AppContainer filesystem-worker claim matches the tree; tracking issue roadmap(windows): make Windows a supported platform #2142 is open as stated.
• docs/windows-test-inventory.md — verified with the repository's own check: npm run windows:inventory passes ("Windows test skip inventory is current (76 declarations)"). The document itself stays untouched: it is generated by scripts/windows-test-inventory.mjs --write, and its --check compares the file byte-for-byte with regenerated output, so hand-added frontmatter on it fails CI (caught by the first CI run; the file is restored to its base revision here).

Verification

Claim	Command / route	Result
Identity/workflow artifacts	ls / grep on the named scripts and .github/workflows/	all resolve
RELEASE.json identity fields	grep scripts/product-release-identity.mjs	sourceCommit etc. present
npm-release zh/en lockstep	heading + flow-keyword comparison	10 sections each; key flow terms parallel
Windows installer name	grep scripts/desktop-release-targets.mjs	Maka-${version}-win-x64.exe exact
Windows inventory currency	npm run windows:inventory	exit 0, 76 declarations current
Generated inventory untouched	node scripts/windows-test-inventory.mjs --check on the branch	exit 0, byte-identical to base
#2142 status	issue API	open
Format / headers	npm run format:check / npm run check:asf-headers	exit 0 / changed files pass

Not re-verified (external to the repository): the winget package id BurntSushi.ripgrep.MSVC in the windows-support install steps is an upstream registry reference.

AI use

Prepared with ZCode (GLM-5.3-Flash): read all five documents, bulk-verified every path-like reference, ran the repository's own inventory check, and added the frontmatter to the hand-maintained documents. The commit carries the Generated-by trailer.

Checklist

• One subsystem group only (CLI and distribution, 5 documents)
• Refs #3522 in the commit message
• Paired translations move together (npm-release pair, translation_status: synced)
• last_verified set to the audit date (2026-09-04)
• Docs only, no code changes