release: isolate website production authority

[0thernet]

Summary

• keeps the tag-triggered Release workflow limited to immutable release publication
• moves website-production promotion into a current-main workflow with read-only baseline and outcome jobs
• scopes the only ref write to a short-lived, one-repository GitHub App token and an explicit expected-old Git lease
• binds immutable tag, npm, GitHub Release, Latest Release, Vercel deployment, and terminal provider evidence fail closed
• documents and tests the later dedicated-App environment, ruleset, and persistent-canary activation boundary

This source change is version-neutral and does not claim that the App, environment, permanent rulesets, or live canary are already active.

Verification

• bun test --no-orphans --timeout 180000 scripts/npm-stage-workflow.test.ts (29/29, 2,857 assertions)
• node --check scripts/release-provider-outcome.mjs
• node --check scripts/release-app-token.mjs
• node --check scripts/release-ref-writer.mjs
• bun run typecheck
• bun run check
• two independent exact-head adversarial reviews: GO

Exact base: f09a6106b9992e7121dfed5299528967c00a31eb

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
wrench	Ready	Preview	Aug 30, 2026 6:30am