added preflight check

build/README.md

@@ -12,6 +12,7 @@ build/
   README.md
   common/                 shared helpers (paths, pyproject, verify)
   wheel/                  SDK .whl (Nuitka + manylinux Docker)
+  release/                local release gate (preflight / audit)
   gui/
     common/               shared PyInstaller driver
     ory_finger/           ORY-FINGER dashboard
@@ -41,6 +42,22 @@ build\wheel\win.bat
 .\build\wheel\docker\run.ps1
 ```
 
+### Release gate
+
+Local only: never publishes, and makes no network call unless `--check-pypi` is
+passed. See `docs/publishing.md` for the full flow.
+
+```bash
+python build/run.py release preflight --version 0.5.2
+python build/run.py release preflight --all-wheel-pythons --check-pypi
+python build/run.py release audit SDK\0.5.2\orisys-0.5.2-cp312-cp312-win_amd64.whl
+```
+
+`preflight` runs: repo state → version consistency → duplicate guard → pytest →
+bundle precheck → per-wheel static content/metadata assertions → isolated runtime
+verification (bundled assets + real frames, no camera). Reports land in
+`build/release/reports/<version>/`.
+
 ### GUI
 
 ```bash
@@ -53,13 +70,16 @@ python build/run.py gui box     # scaffold / NotImplemented
 
 ```bash
 python build/run.py verify path\to\orisys.whl
+python build/run.py verify path\to\orisys.whl --contents --assets --runtime
 python build/run.py verify --gui-dist --product ory_finger
 ```
 
 ## Outputs
 
 - Wheels: `SDK/<version>/`, `dist/repaired/`
+- Preflight reports: `build/release/reports/<version>/`
 - Finger GUI: `dist/OrisysDashboard/`
 - Future mini/box: `dist/OryMini/`, `dist/OryBox/`
 
-Generated work files under `build/nuitka/` and `build/pyinstaller_work/` are gitignored.
+Generated work files under `build/nuitka/`, `build/release/reports/` and
+`build/pyinstaller_work/` are gitignored.