perf(delivery): reduce manifest ancestor validation overhead

backend/tests/test_delivery_io.py

@@ -88,6 +88,18 @@ def ordinary_bundle(tmp_path):
     return bundle, policy.digest(bundle / "manifest.json")
 
 
+@pytest.mark.parametrize("missing", ["frontend", "frontend/admin", "lib", "lib/share"])
+def test_manifest_requires_every_file_and_empty_directory_ancestor(ordinary_bundle, missing):
+    bundle, _ = ordinary_bundle
+    data = json.loads((bundle / "manifest.json").read_bytes())
+    data["directories"].extend(["lib", "lib/share", "lib/share/locale"])
+    assert manifest.validate(data) is data
+
+    data["directories"].remove(missing)
+    with pytest.raises(policy.DeliveryError, match="missing payload parent directory"):
+        manifest.validate(data)
+
+
 def observed_digests(monkeypatch):
     reads = []
     original = manifest.digest

scripts/release/manifest.py

@@ -364,9 +364,12 @@ def validate(data: dict) -> dict:
             raise DeliveryError("duplicate bundle directory")
         directory_set.add(name)
     for name in seen | directory_set:
-        for parent in Path(name).parents:
-            if parent.as_posix() != "." and parent.as_posix() not in directory_set:
+        # Names are already canonical; walk their lexical parent components.
+        parent, separator, _ = name.rpartition("/")
+        while separator:
+            if parent not in directory_set:
                 raise DeliveryError("missing payload parent directory")
+            parent, separator, _ = parent.rpartition("/")
     return data