🤖 ci: fail installer freshness check on untracked generated files

Extend installer freshness validation to fail when generated artifacts are present
but untracked, not just when tracked files differ.

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `$0.82`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=0.82 -->

Author: ThomasK33

.github/workflows/ci.yaml

@@ -159,6 +159,18 @@ jobs:
             config/crd/bases/ \
             config/rbac/
 
+          UNTRACKED_GENERATED="$(git ls-files --others --exclude-standard -- \
+            dist/install.yaml \
+            dist/minimal-installer.yaml \
+            dist/quickstart-installer.yaml \
+            config/crd/bases/ \
+            config/rbac/)"
+          if [[ -n "${UNTRACKED_GENERATED}" ]]; then
+            echo "assertion failed: generated installer artifacts must be tracked" >&2
+            printf '%s\n' "${UNTRACKED_GENERATED}" >&2
+            exit 1
+          fi
+
   scan-fs:
     name: Trivy filesystem scan
     needs: changes