pj f82b459609 refactor(ci): one workflow publishes, because npm allows one trusted publisher ...

npm revoked every classic token in December 2025 and caps a granular one at
90 days, so a token in CI would expire quarterly. OIDC is the only option
left, and it matches a package's single trusted publisher against the
filename of the workflow that starts the run. So the release lives in ci.yml
and nowhere else: release.yml and release-publish.yml are gone, along with
the released_tag the promotion used to re-cut an older commit.

Actions -> ci -> Run workflow, promote=minor|major cuts a milestone, and it
runs the whole suite first like a merge does.

Claude-Session: https://claude.ai/code/session_01ShuAy8q8ZfPi8KHxwc8JpQ

2026-08-16 15:30:17 +05:30

..

ci.yml

refactor(ci): one workflow publishes, because npm allows one trusted publisher

2026-08-16 15:30:17 +05:30