fix(release): create-release.sh carries its own build fallout

Stage Cargo.lock and the regenerated public catalog in the release commit,
and re-fold AIUI into web/dist after the frontend build wipes it. All three
were manual catches on every one of the last three releases: the dirty
files failed the ISO preflight, the missing AIUI failed verify-artifacts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/Cargo.lock

@@ -104,7 +104,7 @@ dependencies = [
 
 [[package]]
 name = "archipelago"
-version = "1.7.128-alpha"
+version = "1.7.129-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

neode-ui/public/catalog.json

@@ -390,7 +390,7 @@
       "author": "Grafana Labs",
       "category": "data",
       "tier": "recommended",
-      "dockerImage": "grafana/grafana:10.2.0",
+      "dockerImage": "source.archipelago-foundation.org/lfg2025/grafana:10.2.0",
       "repoUrl": "https://github.com/grafana/grafana",
       "containerConfig": {
         "ports": [

scripts/create-release.sh

@@ -158,6 +158,16 @@ cd "$PROJECT_ROOT/neode-ui"
 npm run build 2>&1 | tail -3
 cd "$PROJECT_ROOT"
 
+# npm run build wipes web/dist — fold AIUI straight back in. The OTA tarball
+# bakes it from demo/aiui independently, but build-iso-release.sh's
+# verify-artifacts guard checks web/dist/neode-ui/aiui and failed on two
+# consecutive releases (.127, .129) because this fold-in was manual.
+if [ -d "$PROJECT_ROOT/demo/aiui" ] && [ -f "$PROJECT_ROOT/demo/aiui/index.html" ]; then
+    rm -rf "$PROJECT_ROOT/web/dist/neode-ui/aiui"
+    cp -r "$PROJECT_ROOT/demo/aiui" "$PROJECT_ROOT/web/dist/neode-ui/aiui"
+    echo "  AIUI folded into web/dist from demo/aiui"
+fi
+
 # npm run build can silently no-op (vue-tsc EACCES burned us before) — a stale
 # dist would ship with a perfectly valid sha256. Require the freshly built
 # bundle to embed the version we just bumped to before it gets packaged.
@@ -264,12 +274,18 @@ fi
 echo "[7/8] Committing version bump..."
 git -C "$PROJECT_ROOT" add \
     core/archipelago/Cargo.toml \
+    core/Cargo.lock \
     neode-ui/package.json \
     neode-ui/package-lock.json \
+    neode-ui/public/catalog.json \
     CHANGELOG.md \
     releases/manifest.json \
     release-manifest.json \
     2>/dev/null || true
+# Cargo.lock (rewritten by the release build after the version bump) and
+# neode-ui/public/catalog.json (regenerated by the frontend build) belong in
+# THIS commit: leaving them dirty failed build-iso-release.sh's clean-tree
+# preflight on three consecutive releases (.127-.129, 2026-08-09/10).
 
 git -C "$PROJECT_ROOT" commit -m "chore: release v${VERSION}"