[Fork/ABI] Make fresh-instance replay activation-state safe

.github/scripts/test-merge-candidate-workflows.sh

@@ -701,6 +701,10 @@ for workflow in "$STAGING_WORKFLOW" "$PREPARE"; do
   grep -Fq 'run: bash scripts/dev-shell.sh npm ci --no-audit --no-fund' \
     <<<"$root_install_step" ||
     fail "$(basename "$workflow") materialization validation must install the root esbuild dependency"
+  materialization_step="$(step_block "$workflow" "Test binary materialization flow")"
+  grep -Fq 'bash scripts/dev-shell.sh bash scripts/build-fork-instrument-tool.sh' \
+    <<<"$materialization_step" ||
+    fail "$(basename "$workflow") materialization validation must build the fork contract inventory tool"
 done
 
 grep -Fq 'cleanup-merge-candidates.sh' "$CLEANUP_WORKFLOW" || \

.github/workflows/prepare-merge.yml

@@ -1335,6 +1335,10 @@ jobs:
       - name: Test binary materialization flow
         if: env.BINARY_MATERIALIZATION_CHANGED == 'true'
         run: |
+          # WHY: artifact-guard integration tests query the ABI 43 binary
+          # contract inventory. This source-only job does not download the
+          # package-toolchain artifact, so prepare its host tool explicitly.
+          bash scripts/dev-shell.sh bash scripts/build-fork-instrument-tool.sh
           bash scripts/dev-shell.sh npx --prefix host vitest run --root . tests/package-system
 
   test-suite-early:

.github/workflows/staging-build.yml

@@ -852,6 +852,10 @@ jobs:
       - name: Test binary materialization flow
         if: env.BINARY_MATERIALIZATION_CHANGED == 'true'
         run: |
+          # WHY: artifact-guard integration tests query the ABI 43 binary
+          # contract inventory. This source-only job does not download the
+          # package-toolchain artifact, so prepare its host tool explicitly.
+          bash scripts/dev-shell.sh bash scripts/build-fork-instrument-tool.sh
           bash scripts/dev-shell.sh npx --prefix host vitest run --root . tests/package-system
 
   test-suite-early: