fix: harden provider and promotion evidence

scripts/cleanup-verified-promotion.ts

@@ -0,0 +1,25 @@
+import { cleanupFinalizedPromotion } from "./lib/promotion-stager.ts";
+
+const required = (name: string): string => {
+  const value = process.env[name];
+  if (!value) throw new TypeError(`promotion cleanup environment is missing ${name}`);
+  return value;
+};
+const requiredIdentity = (name: string): number => {
+  const value = Number(required(name));
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new TypeError(`promotion cleanup environment has invalid ${name}`);
+  }
+  return value;
+};
+
+await cleanupFinalizedPromotion({
+  runnerTempRoot: required("RUNNER_TEMP"),
+  stagingRoot: required("PROMOTION_STAGING_ROOT"),
+  cleanupToken: required("PROMOTION_CLEANUP_TOKEN"),
+  runnerTempIdentity: {
+    dev: requiredIdentity("PROMOTION_RUNNER_TEMP_DEV"),
+    ino: requiredIdentity("PROMOTION_RUNNER_TEMP_INO"),
+  },
+});
+process.stdout.write("Promotion staging cleanup: PASS\n");