refactor: validate generated evidence artifacts

scripts/verify-release.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 
 import {
@@ -23,6 +23,8 @@ import {
 } from "../src/features/installed-feature-contracts.ts";
 import { assertMatchesJsonSchema } from "./lib/json-schema.ts";
 import { verifyReleaseRuntimeCoherence } from "./lib/release-runtime-coherence.ts";
+import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
+import { releaseVerificationArtifactSchema } from "./contracts/release-artifacts.ts";
 
 type CoherenceFixture = Readonly<{
   name: string;
@@ -212,10 +214,11 @@ const report = {
 };
 
 await mkdir("artifacts/release", { recursive: true });
-await writeFile(
-  "artifacts/release/verification.json",
-  `${JSON.stringify(report, null, 2)}\n`,
-);
+await writeValidatedJsonArtifact({
+  path: "artifacts/release/verification.json",
+  schema: releaseVerificationArtifactSchema,
+  value: report,
+});
 
 if (!passed) {
   process.stderr.write(