release: align staged-publication parser parity

[0thernet]

Summary

• inspect terminal npm staging mutations before trusting a job display name
• require each attempted terminal write to have one successful durable intent at the immediately preceding safe positive step number
• align source/release and checkout-free readers on exact USTAR and prefix semantics
• cover renamed jobs, reversed ordering, unsafe step numbers, hostile signatures, prefixes, and duplicate paths

Verification

• bun run check
• independent parity review: no P0-P2 findings

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
atet	Ready	Preview	Sep 5, 2026 3:39pm UTC