v0.14.1 - Lockstep main and DSH publishing

v0.14.1 - Lockstep main and DSH publishing

Released 2026-08-14.

Patch: makes the public DSH bundle part of every stable release transaction.
One vX.Y.Z tag now drives both npm publishers and one shared GitHub Release.

Fixed release group

• design-playbook and dsh-design-playbook publish at the same version.
• The DSH bundle depends on the matching ^X.Y.Z main-package line.
• Release, validation, and doctor diagnostics consume one shared lockstep
  policy and fail before publication when either invariant drifts.

Ordered publication and verification

• The DSH workflow waits for the exact main-package artifact before it
  publishes.
• The main workflow waits for the exact DSH artifact and verifies its npm
  provenance before creating the single GitHub Release.
• Both packages continue to use separate npm Trusted Publisher workflows with
  job-scoped GitHub OIDC and no long-lived npm token.

Recovery

• Fresh tag runs fail closed when an npm version already exists.
• Explicit manual recovery verifies an existing DSH package without
  republishing it.
• Shared GitHub Release recovery remains available after both registry
  artifacts exist.
• No new dsh-v* tag is created; historical dsh-v0.14.0 records remain
  unchanged.