Release v4.5.1

The publish job can report success while the registry never receives the package. On v4.5.0 npm printed its success line for every workspace, the run stayed green, and @cratis/components was absent from the registry for over an hour — long enough that the released adapters referenced a core version consumers could not install. Re-running the publish job fixed it, but nothing in the pipeline noticed.

verify-published does not cover this. It verifies that an intentional no-release merge was intentional, and by its own condition it never runs on the path where something was published — which is what a separate verification job looks like once its condition has drifted from the thing it verifies.

So this is a step at the end of the job that publishes, not a job beside it. It cannot be skipped independently of the publish it verifies, and it costs no second runner.

Added

• The publishing job asks the registry for every public workspace at the released version, retries briefly for propagation, and fails with the missing package names when they are absent

Verification

The step's exact shell was exercised against the live registry: green for 4.5.0 as published, red with the full missing list for a version that does not exist.