fix: enforce manifest-based component downloads and validate package URLs during release builds

release.js

@@ -247,6 +247,9 @@ async function main() {
     for (const [name, c] of Object.entries(manifestData.components || {})) {
         console.log(`Uploading ${c.file}...`);
         c.url = await uploadFileToGitLabPackage(path.join(__dirname, 'release-assets', c.file), 'vyla-home', version, `${name}-${timestamp}.zip`);
+        if (!c.url || !c.url.includes('/packages/generic/vyla-home/')) {
+            throw new Error(`Upload for ${name} did not return a package URL.`);
+        }
     }
 
     const signingKeyPem = process.env.VYLA_UPDATE_SIGNING_KEY;