test: add reproducible FreeCAD golden oracle

scripts/verify-freecad-source.mjs

@@ -0,0 +1,12 @@
+import { execFileSync } from 'node:child_process'
+import { readFile } from 'node:fs/promises'
+
+const toolchain = JSON.parse(await readFile(new URL('../config/freecad-toolchain.json', import.meta.url), 'utf8'))
+const reference = `refs/tags/${toolchain.source.tag}`
+const output = execFileSync('git', ['ls-remote', toolchain.source.repository, reference], { encoding: 'utf8', timeout: 30000 }).trim()
+const [resolved, resolvedReference] = output.split(/\s+/)
+if (resolvedReference !== reference || resolved !== toolchain.source.commit) {
+  console.error(`FreeCAD tag mismatch: expected ${reference} @ ${toolchain.source.commit}, received ${output || 'no result'}.`)
+  process.exit(1)
+}
+console.log(`FreeCAD source tag verified: ${reference} @ ${resolved}.`)