fix(eve): publish PR package artifacts automatically

[AndrewBarba]

Summary

PR package publishing currently requires a manual workflow run, and that run rejects valid builds because it queries a workflow status as though it were a conclusion. This makes publication automatic for same-repository PRs after the credential-free build and reports a user-facing Package artifact status only when the tarball is ready. Fork PRs are excluded from both package building and publishing, with a second trusted resolver check enforcing that boundary.

The credentialed publisher remains a separate default-branch workflow so PR code cannot read the Blob token or alter publication logic. It revalidates the current branch or PR head immediately before updating its mutable pointer. Failed builds and publication failures report a failed package status rather than silently leaving users without a result.

Validation

• pnpm --filter eve-package-artifacts test — 5 test files and 22 tests passed.
• docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.7 -color .github/workflows/build-tarball.yml .github/workflows/publish-tarball.yml — passed.
• pnpm exec oxlint apps/package-artifacts — passed with 0 warnings and 0 errors.
• pnpm exec oxfmt --check .github/workflows/build-tarball.yml .github/workflows/publish-tarball.yml apps/package-artifacts/README.md apps/package-artifacts/lib/publication-current.mjs apps/package-artifacts/lib/publication-current.test.mjs apps/package-artifacts/lib/publication-target.mjs apps/package-artifacts/lib/publication-target.test.mjs apps/package-artifacts/scripts/publish.mjs — passed.
• Verified the same-repository lookup against live PR feat(eve): onboarding - go from init directly to chat #3356 metadata and verified fork PR fix(eve): preserve ChatGPT cache identity with session header #3311 is excluded by repository identity.
• Independent final code review reported no remaining findings before the explicit fork exclusion; the focused checks above were rerun after that change.

Checklist

• This change was requested or approved by a maintainer
• I ran the relevant checks from CONTRIBUTING.md
• I added tests and documentation where relevant
• I added a changeset if this touches the published eve package
• DCO sign-off passes for every commit (git commit --signoff)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
eve-docs	Ready	Preview, v0	Sep 14, 2026 10:41pm UTC
eve-docs-4759	Ready	Preview, v0	Sep 14, 2026 10:41pm UTC
eve-pkg	Ready	Preview, v0	Sep 14, 2026 10:41pm UTC

[e0-gh-vercel-connect]

I hit an error while handling your request (API key budget exceeded. Current spend: $754.28, limit: $750.00. Please contact your administrator to increase the budget.).

Please try again, rephrase, or reach out if it keeps failing.

Error id: 438c2c0d-ce09-4947-814b-040c3de5a216

[e0-gh-vercel-connect]

I hit an error while handling your request (API key budget exceeded. Current spend: $756.25, limit: $750.00. Please contact your administrator to increase the budget.).

Please try again, rephrase, or reach out if it keeps failing.

Error id: 042617f9-4b88-4def-aa1b-9a3b8b77bddc