test: prove dedicated release App authority

[0thernet]

Summary

Adds the temporary, single-use proof surface for Wrench’s dedicated production-ref writer.

• binds the persistent canary to landed direct-child commits f09a6106… → 4aed45b…
• requires current-main workflow source, exact repository/actor/run identity, App installation scope, explicit leased Git CAS, token revocation, and fail-closed evidence
• retains canonical bounded evidence in the job log and summary for API retrieval
• documents that the four paths are removed after the one successful proof and are never reused for production promotion

This PR does not create the App, environment, rulesets, canary ref, release, tag, npm stage, or production ref mutation.

Verification

• bun test --no-orphans --timeout 180000 scripts/npm-stage-workflow.test.ts — 36 pass, 2,983 assertions
• bun run typecheck
• node --check scripts/release-app-canary.mjs
• bun run check — website 57/57; main 3,345 pass / 1 intentional skip / 0 fail / 143,011 assertions; Omni 18/18 / 606 assertions; standalone smoke green
• git diff --check
• clean dist and bun.lock

Exact reviewed head before publication: 2b60fa8bb516d999d30dfd5b7700809419d7b44d; tree 0cdc091e25793d59039d2a9df9363e04ea4c622c; binary diff SHA-256 245e987da3f6044e86bd12afa6c324c0b25e7a3f021281f17be0bde873cd2cfe.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
wrench	Ready	Preview	Aug 30, 2026 8:31am