feat(reliability): implement build reliability service with git integrity, reserved filename cleanup, and build archival

Adds BuildReliabilityService with the following capabilities:
- checkGitIntegrity(): runs git fsck --no-dangling and parses output for corruption
- cleanStaleLockFiles(): removes stale .lock files older than 10 minutes
- validateSubmoduleBackingStores(): validates .git files point to valid backing stores
- recoverCorruptedRepo(): orchestrates fsck, lock cleanup, re-fetch, retry fsck
- cleanReservedFilenames(): removes Windows reserved filenames (con, prn, aux, nul, com1-9, lpt1-9)
- archiveBuildOutput(): creates tar.gz archive of build output
- enforceRetention(): deletes archives older than retention period
- configureGitEnvironment(): sets GIT_TERMINAL_PROMPT=0, http.postBuffer, core.longpaths

Wired into action.yml as opt-in inputs, with pre-build integrity checks and
post-build archival in the main entry point.

Includes 29 unit tests covering success and failure cases for all methods.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/index.ts

@@ -3,6 +3,7 @@ import { Action, BuildParameters, Cache, Orchestrator, Docker, ImageTag, Output
 import { Cli } from './model/cli/cli';
 import MacBuilder from './model/mac-builder';
 import PlatformSetup from './model/platform-setup';
+import { BuildReliabilityService } from './model/orchestrator/services/reliability';
 
 async function runMain() {
   try {
@@ -14,11 +15,38 @@ async function runMain() {
     Action.checkCompatibility();
     Cache.verify();
 
+    // Always configure git environment for CI reliability
+    BuildReliabilityService.configureGitEnvironment();
+
     const { workspace, actionFolder } = Action;
 
     const buildParameters = await BuildParameters.create();
     const baseImage = new ImageTag(buildParameters);
 
+    // Pre-build reliability checks
+    if (buildParameters.gitIntegrityCheck) {
+      core.info('Running git integrity checks...');
+
+      const isHealthy = BuildReliabilityService.checkGitIntegrity(workspace);
+      BuildReliabilityService.cleanStaleLockFiles(workspace);
+      BuildReliabilityService.validateSubmoduleBackingStores(workspace);
+
+      if (buildParameters.cleanReservedFilenames) {
+        BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
+      }
+
+      if (!isHealthy && buildParameters.gitAutoRecover) {
+        core.info('Git corruption detected, attempting automatic recovery...');
+        const recovered = BuildReliabilityService.recoverCorruptedRepo(workspace);
+        if (!recovered) {
+          core.warning('Automatic recovery failed. Build may encounter issues.');
+        }
+      }
+    } else if (buildParameters.cleanReservedFilenames) {
+      // cleanReservedFilenames can run independently of gitIntegrityCheck
+      BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
+    }
+
     let exitCode = -1;
 
     if (buildParameters.providerStrategy === 'local') {
@@ -37,6 +65,13 @@ async function runMain() {
       exitCode = 0;
     }
 
+    // Post-build: archive and enforce retention
+    if (buildParameters.buildArchiveEnabled && exitCode === 0) {
+      core.info('Archiving build output...');
+      BuildReliabilityService.archiveBuildOutput(buildParameters.buildPath, buildParameters.buildArchivePath);
+      BuildReliabilityService.enforceRetention(buildParameters.buildArchivePath, buildParameters.buildArchiveRetention);
+    }
+
     // Set output
     await Output.setBuildVersion(buildParameters.buildVersion);
     await Output.setAndroidVersionCode(buildParameters.androidVersionCode);