fix(ci): exempt a package's first publish from the version contract

[mfal]

Closes #2980.

The problem

Going private: true → public while adding engines.node fails the version-contract guard:

::error::@mittwald/flow-codemods: engines.node raised ((none) -> >=24.0.0)
::error::Version contract: a breaking engines.node/peer change is not marked breaking.

Neither remedy the message offers is available:

• A breaking marker routes to the major line, and the routing job in the same workflow rejects a breaking marker on a standing line. The two guards contradict each other for this change.
• Dropping the floor means publishing a CLI without one, while its code uses import attributes, structuredClone and toSorted. On an older Node that is a bare SyntaxError with no hint why, and all twelve already-published packages declare a floor.

Why the guard is wrong here, and only here

A private: true package has never been published. No consumer, no prior contract — its first publish establishes the floor and the peer ranges rather than narrowing them.

collectFindings already skips a package with no base file at all, for exactly this reason:

if (!isPublishable(head)) continue; // not a consumer-facing Flow package
if (!base) continue; // new package: no prior contract to break

The gap was the case in between: the package existed at the base but was not publishable. This adds that line.

What is deliberately not changed

The rule for anything already on npm. The second of the two added tests is the one that matters — it pins that @mittwald/flow-react-components gaining engines.node is still reported as raised, so this is an exemption for the first publish, not a hole in the guard.

I also checked it by hand: with the fix applied, an artificial "already-published package gains a floor" still produces the finding, and the guard goes green on #2978's branch.

Route

fix(ci): → main, from where the forward-merge carries it to next. #2978 targets next and is blocked on this; the cascade unblocks it without that PR needing to carry CI infrastructure.

14 guard tests pass (12 existing, 2 added).

[github-actions]

Coverage Report for ./packages/components/

Status	Category	Percentage	Covered / Total
🔵	Lines	76%	627 / 825
🔵	Statements	75.91%	643 / 847
🔵	Functions	77.95%	145 / 186
🔵	Branches	66.66%	298 / 447

File Coverage

No changed files found.

Generated in workflow #6371 for commit 6d794ff by the Vitest Coverage Report Action

[github-actions]

🚀 Preview Deployment

Preview environments are ready:

Type	URL
docs	pr-2982.docs.review.flow-components.de
storybook	pr-2982.storybook.review.flow-components.de

Images:

• docs: ghcr.io/mittwald/flow/docs:pr-2982
• storybook: ghcr.io/mittwald/flow/storybook:pr-2982