fix: cover every tracked release input

scripts/lib/build-manifest-outputs.ts

@@ -13,6 +13,8 @@ type VerifyBuildManifestOutputsDependencies = Readonly<{
   assertDirectory?: (target: string) => Promise<void>;
 }>;
 
+export const CANONICAL_VITE_MANIFEST_PATH = "dist/.vite/manifest.json";
+
 function isSafeRelativePath(value: string): boolean {
   return (
     value.length > 0 &&
@@ -28,7 +30,12 @@ function isSafeRelativePath(value: string): boolean {
 
 function isWithinRoot(root: string, target: string): boolean {
   const relative = path.relative(root, target);
-  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+  return (
+    relative === "" ||
+    (relative !== ".." &&
+      !relative.startsWith(`..${path.sep}`) &&
+      !path.isAbsolute(relative))
+  );
 }
 
 function belongsToApprovedRoot(value: string, approvedRoot: string): boolean {
@@ -127,12 +134,16 @@ export async function verifyBuildManifestOutputs(
   } else {
     await confinedPath("directory", manifest.outputs.directory, "directory");
   }
-  await confinedPath(
-    "viteManifest",
-    manifest.outputs.viteManifest,
-    "file",
-    "dist",
-  );
+  if (manifest.outputs.viteManifest !== CANONICAL_VITE_MANIFEST_PATH) {
+    mismatches.push("buildManifest:viteManifest:path");
+  } else {
+    await confinedPath(
+      "viteManifest",
+      manifest.outputs.viteManifest,
+      "file",
+      "dist",
+    );
+  }
   await confinedPath(
     "runtimeConfigSchema",
     manifest.outputs.runtimeConfigSchema,