fix(ci): point release-metadata checks at the relocated update and publish guards

CI run 121 failed at "버전·계약 정본 대조": earlier refactors moved update
gating from UpdateService into update-policy.ts (evaluateUpdateOffer ties
decideUpdate + isWithinRollout), the differential-download switch into
update-adapters.ts, and the Forgejo re-release guard into
lib/immutable-package-guard.mjs (sha256 comparison, abort on conflict).
The checks still looked for the old markers in the old files. They now
verify the same guarantees where the code lives, and the self-test's
negative case targets assertNoImmutableConflicts.

Also clears the lint gate: a control-character regex in Keycap (range now
starts at U+0020) and unused helpers in two red-team tests.

scripts/ci/verify-release-metadata.mjs

@@ -30,6 +30,7 @@ function loadSurfaces(readSurface = read) {
     updateFeed: readSurface('apps/desktop/src/main/update-feed.ts'),
     updatePolicySource: readSurface('apps/desktop/src/main/update-policy.ts'),
     updateService: readSurface('apps/desktop/src/main/services/UpdateService.ts'),
+    updateAdapters: readSurface('apps/desktop/src/main/services/update-adapters.ts'),
     publisher: readSurface('scripts/ci/publish-gitlab-release.mjs'),
     forgejoPublisher: readSurface('scripts/ci/publish-forgejo-release.mjs'),
     gitlab: readSurface('.gitlab-ci.yml'),
@@ -166,14 +167,19 @@ function validate(surfaces) {
       surfaces.updatePolicySource.includes('isWithinRollout'),
     'update_policy_runtime_logic_missing',
   )
+  // 정책 판단(decideUpdate + isWithinRollout)은 update-policy.ts 의 evaluateUpdateOffer 가 묶는다.
+  // UpdateService 는 그 한 함수로 게이팅하고 킬 스위치를 직접 본다(2026-09 리팩터로 판단이 서비스 밖으로 옮겨졌다).
   fail(
-    surfaces.updateService.includes('decideUpdate') &&
-      surfaces.updateService.includes('isWithinRollout') &&
+    surfaces.updatePolicySource.includes('export function evaluateUpdateOffer') &&
+      /evaluateUpdateOffer[\s\S]*decideUpdate\(/.test(surfaces.updatePolicySource) &&
+      /evaluateUpdateOffer[\s\S]*isWithinRollout\(/.test(surfaces.updatePolicySource) &&
+      surfaces.updateService.includes('evaluateUpdateOffer(') &&
       /\bkillSwitch\b/.test(surfaces.updateService),
     'update_service_policy_enforcement_missing',
   )
+  // 차등(증분) 다운로드 제어는 UpdateService 가 위임하는 update-adapters.ts 의 전자 업데이터 어댑터에 있다
   fail(
-    surfaces.updateService.includes('disableDifferentialDownload'),
+    surfaces.updateAdapters.includes('disableDifferentialDownload'),
     'update_service_differential_control_missing',
   )
 
@@ -191,8 +197,10 @@ function validate(surfaces) {
   fail(surfaces.forgejoPublisher.includes('verifyPublicFile'), 'forgejo_publisher_public_verification_missing')
   fail(surfaces.forgejoPublisher.includes('update-policy.json'), 'forgejo_publisher_policy_upload_missing')
   fail(surfaces.forgejoPublisher.includes('CHANGELOG.md'), 'forgejo_publisher_changelog_gate_missing')
+  // 재게시 방지: 버전별 불변 경로의 원격 sha256 과 로컬을 비교해 다르면 중단한다(lib/immutable-package-guard.mjs)
   fail(
-    surfaces.forgejoPublisher.includes('assertVersionNotRepublished'),
+    surfaces.forgejoPublisher.includes('classifyImmutableAssets') &&
+      surfaces.forgejoPublisher.includes('assertNoImmutableConflicts('),
     'forgejo_publisher_rerelease_guard_missing',
   )
   fail(
@@ -309,7 +317,7 @@ if (process.argv.includes('--self-test')) {
   expectRejected(
     surfaces,
     (candidate) => {
-      candidate.forgejoPublisher = candidate.forgejoPublisher.replaceAll('assertVersionNotRepublished', 'uploadAnyway')
+      candidate.forgejoPublisher = candidate.forgejoPublisher.replaceAll('assertNoImmutableConflicts(', 'uploadAnyway(')
     },
     'forgejo_publisher_rerelease_guard_missing',
   )