fix(release): reconcile exact package artifacts across registries

[drewstone]

Change

Build on merged #123, which introduced the exact npm tarball mirror. This PR makes that mirror retryable from registry state: it fetches each versioned public package from npm, checks integrity and manifest, and installs the tarballs in a fresh directory outside the workspace before considering a mirror publish. It compares each GitHub Packages copy by integrity, publishes only a missing version, and reconciles any missing GitHub Release independently of Changesets' per-run published-packages output. A rerun after partial publication can therefore resume from registry state.

Current registry proof

• @tangle-network/ui@11.10.0 on GitHub Packages has peer @tangle-network/brand: ^1.6.0, with no workspace: range. Its SHA-512 integrity matches npm: sha512-+LQDHpc2xy4aUID29qZxGvIIKLHGbOt53B8dDD6LaJiEP7im5WzTdAddyDl7M7FileaPSEeEA4pemJC/SvCW7A==.
• Downloaded the UI 11.10.0 and Brand 1.7.0 tarballs from GitHub Packages using the verified drewstone account. A strict npm install from those local tarballs in /tmp/brand-registry-consumer-Et1PPX/consumer, outside the repo, succeeded: 229 packages, no --legacy-peer-deps or --force; npm ls --depth=0 reports UI 11.10.0, Brand 1.7.0, and no problems. The current UI copy is installable.
• Brand 1.7.0 was packed independently before this fix. Its npm integrity is sha512-8dz8vDvWvkEGVTZ9pTqpUZ1f2/5H+AR6umYpxs8ChBAUrL6zo/Q66Zcyxk4pRNv7qJoLv0KVqsrPBYFNovNTYg==; GitHub Packages is sha512-vt83oeRU/7eYw7novRHTWzkGHMT3YrSmdwCpnLfnm2tvPmG69RO8PXMX/0HYdK/r8/cur0p2uqdwWaswTmKutQ==. The sole explicit legacy exception records those exact bytes. All later mismatches fail the release.

Verification

• actionlint .github/workflows/release.yml and git diff --check: pass.
• Executed the workflow's npm artifact preparation step against live npm: integrity and manifest checks passed for Brand 1.7.0 and UI 11.10.0; the strict external install succeeded with 229 packages.
• Executed the workflow's GitHub Packages reconciliation step against live registry metadata without a publish: it accepted only the documented Brand 1.7.0 exception and confirmed UI 11.10.0 matches npm exactly.
• Checked first-parent source recovery: Brand 1.7.0 resolves to 6533dd87; UI 11.10.0 to cf465c3b, their version-introduction merges. Existing GitHub Releases are present.
• Missing-version publication and missing-release creation are intentionally unexercised until a real release needs them. No package was published by this PR validation.

The change is limited to recovery and verification in the Brand release workflow, plus its exact historical exception. Revert this PR to restore the prior behavior.

[changeset-bot]

⚠️ No Changeset found

Latest commit: fc68212

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[tangletools]

✅ Auto-approved drewstone PR — d14db985

This PR was opened by the trusted drewstone account.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-24T07:48:21Z}

[tangletools]

✅ Auto-approved drewstone PR — fc682129

This PR was opened by the trusted drewstone account.
No automated review runs on this PR. This approval rests on the rule above alone.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-24T07:52:18Z}