release: harden and publish the HRA CLI

[0thernet]

Summary

• replace the private GitHub Oh dependency with exact public @hraness/oh@0.2.7
• harden immutable GitHub/npm recovery, exact packument parsing, and current Fulcio identity admission
• isolate release-runner history to reviewed main plus the exact annotated tag while retaining the full all-ref privacy scan
• bound installer acceptance and publish truthful two-phase local-CLI status without claiming hosted sync

Validation

• clean release-shaped full gate: 2,159 tests and 112,606 expectations
• lint, typecheck, site and CLI builds, package inventory, local/global install, PTY, and daemon acceptance passed
• installer acceptance: 27/27
• independent ref-isolation rehearsals for both tag and SHA checkouts passed
• independent release-policy review found no blockers

Release transition

After merge and production deployment, the governed annotated v0.1.0 tag will publish the exact reviewed tarball through npm trusted publishing and an immutable GitHub Release. Hosted sync remains explicitly unavailable.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hra	Ready	Preview	Aug 31, 2026 5:59am