Also check the pack from a clean output directory

The loader check added alongside the packaging change runs on the nupkg CI
publishes, and CI builds before it packs. So `$(OutputPath)` is already
populated by then, and a return to gathering the closure with a wildcard over
that directory would still produce a complete package and still pass. Measured:
with the wildcard restored, packing the built tree yields all ten assemblies
and the check passes, while packing into an empty output directory yields two
and the plugin fails to load. The check could not catch the regression it
exists to catch.

Pack again into an output directory that is guaranteed empty, and run the same
loader check on that package. Relocating `$(OutputPath)` rather than reordering
the CI steps means the check keeps testing the cold condition however the job
is rearranged later.

Verified by mutation: with the wildcard restored, the new check fails with the
same `ReflectionTypeLoadException` a consumer would see, while the check on the
published artefact still passes - so the two are testing different things and
both are worth having.

Found by Codex.

Author: Smaug123

.github/workflows/ci.yaml

@@ -171,6 +171,11 @@ jobs:
       # package has to carry the plugin's dependency closure. Nothing else here would notice if it
       # stopped doing so; the consumer's build would be the first to find out.
       run: nix develop --command ./scripts/check-packed-plugin-loads.sh WoofWare.Myriad.Plugins/bin/Release/WoofWare.Myriad.Plugins.*.nupkg
+    - name: Check the plugin also packs from a clean output directory
+      # The step above cannot catch a return to gathering the closure with a wildcard over
+      # $(OutputPath), because the Build step above has already filled that directory. This one
+      # packs into an empty one, which is the condition that used to produce a broken package.
+      run: nix develop --command ./scripts/check-cold-pack-loads.sh
     - name: Upload NuGet artifact (plugin)
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:

scripts/check-cold-pack-loads.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+
+# The plugin's dependency closure must reach the package by a route that does not depend on the
+# build directory already being populated. It used not to: the closure was gathered by a wildcard
+# over $(OutputPath), which MSBuild expands when the project is evaluated, before the build that
+# fills that directory. A package built that way carries only the plugin itself and fails to load.
+#
+# Checking the nupkg that CI publishes cannot catch a regression to that, because CI builds before
+# it packs, so $(OutputPath) is populated by then and even the wildcard would find everything. So
+# pack again into an output directory that is guaranteed empty, and check that package instead.
+# Relocating $(OutputPath) rather than reordering the CI steps keeps this honest no matter what
+# else the job has done first.
+
+set -eu
+
+if [ "$#" -ne 0 ]; then
+    echo "usage: $0" >&2
+    exit 1
+fi
+
+repo=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+
+workdir=$(mktemp -d)
+# shellcheck disable=SC2064 # expand workdir now, while it is still set
+trap "rm -rf '$workdir'" EXIT
+
+dotnet pack "$repo/WoofWare.Myriad.Plugins/WoofWare.Myriad.Plugins.fsproj" \
+    --configuration Release \
+    -p:BaseOutputPath="$workdir/bin/" \
+    --output "$workdir/nupkg"
+
+# shellcheck disable=SC2086 # deliberate: expand the glob into the argument list to count matches
+set -- "$workdir"/nupkg/*.nupkg
+if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then
+    echo "expected exactly one nupkg from the clean-output pack, got: $*" >&2
+    exit 1
+fi
+
+"$repo/scripts/check-packed-plugin-loads.sh" "$1"