Gate npm publication on exact-tag cross-platform E2E

[solnikhil]

Summary

• make the tag-triggered publish workflow call Live E2E as a reusable prerequisite at the same ref
• require Linux, macOS, and Windows E2E success before the protected publish job is eligible to run
• serialize publication attempts per tag and scope OIDC permission to the publish job
• retire the historical token bootstrap workflow
• add a release-policy test that prevents the dependency, platform matrix, concurrency, or token policy from drifting
• update the release runbook to describe the enforced control and exact-tag retries

Verification

• npm test (368 passed)
• npm audit --omit=dev --audit-level=high (0 vulnerabilities)
• npm run verify:package
• actionlint v1.7.12
• git diff --check

Closes #20

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: add098d8-af06-4d49-921b-845ea464aeb9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}