release: repair HRA CLI publication as v0.1.2

[0thernet]

Summary

• preserve immutable failed v0.1.1 release evidence and advance the forward release to v0.1.2
• keep generated and downloaded release artifacts under the runner temporary directory, outside the checked public source tree
• harden parsed workflow-path, retry, npm PURL, and Fulcio identity regressions for v0.1.2
• keep package, installer, public copy, and immutable release identity exact

Root cause

The v0.1.1 release verified and checksum-validated its tarball, but both exact-artifact jobs staged SHA256SUMS inside the checkout. The public package gate correctly rejected that unreviewed extensionless workflow file. Publication never ran.

Verification

• complete bun run check in an isolated full-history candidate clone
• 542/542 scripts tests
• complete source, Convex, and site suites
• package policy and exact package acceptance
• isolated local and global consumers, restored PTY shell, and global daemon lifecycle
• independent release-safety review
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hra	Ready	Preview	Aug 31, 2026 8:19am