mk-release: anchor output/dist arguments to the caller's cwd

[mcfbytes]

The failure

Run 35033662179 (v2026.09.15-beta) died in Stage, package and verify the release assets:

scripts/mk-release.sh: line 85: dist/release_20260915.7z: No such file or directory
    wrote dist/release_20260915.7z ( bytes)
...
verify-stock-payload.sh: roundtrip: 'dist/release_20260915.7z' does not exist

Nothing upstream was yanked. The stock payload fetch/verify passed clean in the same run:

fetch-stock: 2 volume(s) joined -> .../release-work/stock_release.7z
verify-stock: ... verified -- size/MD5/SHA-256/internal-CRC all match.
verify-uboot: uboot.img and updateboot confirmed byte-identical to stock.

Cause

release.yml calls scripts/mk-release.sh output dist, so $dist was the relative string dist. Step 4 packs the archive from inside a subshell that has cd'd to release-work/release-stage:

( cd "$work/release-stage" && 7z a ... "$dist/release_$release_date.7z" files/ )

7z creates a missing output directory and exits 0, so the pack "succeeded" — into release-work/release-stage/dist/release_20260915.7z. Verified locally: 7z a dist/x.7z from a directory with no dist/ returns 0 and makes the directory.

The next line's wc -c redirection then failed inside a command substitution, which set -e does not catch, so the run limped on to the round-trip step and died there with a misleading message pointing at the stock payload script.

The default invocation (out=$ROOT/output, dist=$ROOT/dist) is absolute, which is why local runs never hit this — only the CI call site passes relative paths.

Fix

• Absolutize both arguments before anything changes directory.
• Assert the pack's own product, so a future variant of this fails at the line that caused it instead of three steps later.

shellcheck -x scripts/mk-release.sh is clean.

To ship 20260915

This needs to be on the tagged commit, so v2026.09.15-beta has to be re-cut after merge.

🤖 Generated with Claude Code