Preserve build errors and available failure evidence

cmd/releasekit/internal/cli/config.go

@@ -105,6 +105,9 @@ func Parse(args []string) (Invocation, error) {
 				return Invocation{}, errors.New("ci-deliver TAG must end in a stable vMAJOR.MINOR.PATCH version")
 			}
 		}
+		if !versioncontract.ValidStableVersion(version) {
+			return Invocation{}, errors.New("VERSION must be a stable vMAJOR.MINOR.PATCH version")
+		}
 		parsedRemote := ""
 		if remote != nil {
 			parsedRemote = *remote

cmd/releasekit/repository_test.go

@@ -23,3 +23,12 @@ func TestNativeCheckFromChildUsesRootProfileAndSuite(t *testing.T) {
 		t.Fatalf("child invocation error = %v, output = %s", err, output)
 	}
 }
+
+func TestNativeBuildClassifiesInvalidVersionBeforeSourceAccess(t *testing.T) {
+	binary := buildWorkflowCLI(t, cliRepositoryRoot(t))
+	command := exec.Command(binary, "build", "--repo", filepath.Join(t.TempDir(), "absent"), "bad-version")
+	output, err := command.CombinedOutput()
+	if exit, ok := err.(*exec.ExitError); !ok || exit.ExitCode() != 2 || !strings.Contains(string(output), "stable vMAJOR.MINOR.PATCH") {
+		t.Fatalf("invalid build error = %v, output = %s", err, output)
+	}
+}