ci: harden release automation

[ByBrawe]

Summary

• Keep normal v* tag publishing.
• Add a controlled release/npm-v* branch trigger for environments that cannot create Git tags directly.
• Always publish the package from main for release-branch runs, never from branch contents.
• Verify package version and reject pre-existing tags before publishing.
• Run npm ci, syntax checks, the full test suite, and npm pack --dry-run before publish.
• Disable package-manager caching in release jobs per current npm Trusted Publishing guidance.
• After a release-branch publish succeeds, create the annotated tag and GitHub Release at the tested main commit and clean up the one-shot branch.

This keeps the existing tag workflow while making releases reproducible and safe to trigger without a direct tag API.

[Copilot]

Pull request overview

This PR hardens the npm publish workflow by adding a controlled release/npm-v* branch trigger, enforcing release-version verification, and (for branch-triggered releases) creating the tag + GitHub Release from the tested main commit and cleaning up the one-shot branch.

Changes:

• Add release/npm-v* branch trigger and resolve whether the run is tag-based or release-branch-based, checking out main for release-branch runs.
• Add release-version verification against package.json and a remote-tag existence guard.
• After successful release-branch publish, create an annotated tag + GitHub Release and delete the one-shot release branch.

Suppressed comments (1)

.github/workflows/publish-npm.yml:86

• This step pushes a v* tag, which will re-trigger this same workflow via on.push.tags: v*. Because the release-branch run already published to npm, the follow-up tag run will attempt to publish the same version again (typically failing and leaving a noisy red workflow). Consider skipping npm publish when the tag push actor is github-actions[bot] so tags created by the workflow don't republish.

          git tag -a "$TAG" "$COMMIT_SHA" -m "Release $TAG"
          git push origin "$TAG"
          zip -r opencode-loop.zip . -x ".git/*" "node_modules/*" "opencode-loop.zip"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.