fix: harden release preparation and publish handoff

[tensornull]

Summary

• make Release Please run for source-only fixes and classify unchanged-version pushes as patch preparation
• hand completed releases to a tag-bound workflow_dispatch without holding the shared publish concurrency slot while the dispatched run queues
• add fail-closed validation for the exact tag workflow, Release Please run set, npm Environment policy IDs, artifact identity, registry state, signatures, and provenance
• add one narrowly bound recover-v0.1.1 main-dispatch path that can reuse the already live-verified artifact after a temporary exact branch:main npm Environment policy is human-approved
• reject reruns and every observed second same-control-commit recovery dispatch both before verification and immediately before npm publication, including truncated workflow-run searches
• document state capture, response-loss handling, exact pending-deployment review, PR author self-approval semantics, and guaranteed restoration to RELEASE_PLEASE_ENABLED=false plus only tag:v*

Root cause

The earlier flow had three independent failure modes:

1. Release Please listened only to package.json changes, so a normal source-only fix: commit could not prepare the expected patch PR.
2. A GitHub Release created with the default token does not create a usable downstream release event, while the prior main-context publish path produced a main deployment rejected by the tag-only npm Environment policy.
3. The immutable v0.1.1 tag predates the corrected dispatch entry point; GitHub resolves the requested ref workflow and cannot borrow the newer default-branch definition.

The permanent design is Release Please result → unprivileged handoff → exact immutable-tag dispatch → verify/live/npm OIDC. The main path is a one-time, commit/file/actor/run/artifact/policy-ID-bound recovery only for the already-created v0.1.1.

Scope and safety

The intended merge control commit must have first parent 5f493045a2205fe19904ca5be36f5bbf23378aec and must change exactly these six files:

• .github/workflows/publish.yml
• .github/workflows/release-please.yml
• RELEASING.md
• scripts/release-workflow-validation.mjs
• tests/release-workflow-validation.test.mjs
• tests/workflow-contract.test.mjs

It does not change package source, version, tag, release, protections, secrets, Trusted Publisher settings, or npm ownership. Before any recovery mutation, the owner must complete npm 2FA and visually reconfirm Trusted Publisher = cometapi-dev/cometapi-node / publish.yml / Environment npm.

GitHub prohibits PR authors from approving their own PRs even when they are administrators. This PR therefore requires an exact-final-head COMMENTED owner audit record when the author and reviewer are both tensornull; that record is not represented as a formal APPROVED review. The action-authored Release Please PR still requires formal final-head approval from a different human administrator.

Verification

• npm ci
• npm run verify:offline
• 524 Vitest tests
• secret, standalone-content, public-preview, and self-contained gates
• package/tarball validation, publint, Are the Types Wrong
• README ESM/CommonJS examples and compatible-OpenAI host fixture
• locked OpenAI 6.47.0 compatibility locally; required minimum/locked/Node 22/24 and advisory Node 26 lanes run remotely
• actionlint 1.7.12
• git diff --check
• a live read-only GitHub API probe proving a historical duplicate same-SHA run set is rejected
• independent clean-copy and adversarial workflow audits

Frozen diff SHA-256: 449370f789f317d15664a96a8ccec3b4eba42a4c8aaf24df07eb9b5f3f07724f.

[tensornull]

Reviewed final head 11871d9 and authorize its merge and the one-time
v0.1.1 recovery