ci(release): 关 Defender 实时扫描 + 打包后冒烟验 PKG

v0.2/v0.3/v0.3.1 发版 exe(raw artifact 同样)报
"Could not load PyInstaller's embedded PKG archive"，但本地同 spec 打包能跑。
排除 UPX/7z 后，高度怀疑 CI windows-latest 的 Defender 实时扫描在 PyInstaller
写入 exe 时改动 PKG archive。

- Build 前禁用 Defender 实时扫描 + 工作区加排除路径
- Build 后立即 offscreen 跑 exe 冒烟，grep "Could not load PyInstaller"
  → CI 当场验证 PKG 能加载，产出损坏的 exe 不再发版

Author: Windsland52

.github/workflows/release.yml

@@ -25,8 +25,29 @@ jobs:
             - run: pnpm install --frozen-lockfile
             - run: pnpm check
             - run: pnpm check:py
+            - name: Disable Windows Defender realtime monitoring
+              shell: powershell
+              run: |
+                  # PyInstaller 写入 exe 时 Defender 实时扫描会改动 PKG archive，
+                  # 导致产出的 exe "Could not load embedded PKG archive"。打包前关掉。
+                  Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
+                  Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE" -ErrorAction SilentlyContinue
+                  Write-Host "Defender realtime monitoring disabled for build"
             - name: Build (PyInstaller)
               run: uv run pyinstaller aao.spec --noconfirm
+            - name: Smoke test packaged exe
+              shell: bash
+              run: |
+                  # 打包后立即 offscreen 跑，验证 PKG archive 能加载（CI 自检，避免产出损坏的 exe 还发版）
+                  export QT_QPA_PLATFORM=offscreen
+                  timeout 20 ./dist/aao.app/aao.app.exe --no-api > smoke.log 2>&1 || true
+                  if grep -q "Could not load PyInstaller" smoke.log; then
+                    echo "[ERR] packaged exe failed to load PKG archive"
+                    cat smoke.log
+                    exit 1
+                  fi
+                  echo "[OK] packaged exe loads PKG archive"
+                  head -5 smoke.log
             - name: Download AFA (ArknightsFrameAssistant)
               shell: bash
               run: |