Automate verified GitHub releases without automatic npm publication

[cervantesh]

Maturity context

• Project maturity: operational (66/100)
• Dimension: release_maintenance
• Priority: medium

Evidence

• No release workflow exists under .github/workflows
• docs/RELEASING.md requires manual verification, tagging, and GitHub release creation
• scripts/verify-release.mjs and npm run verify already check package/changelog metadata
• Five releases exist through v0.6.0 while main contains unreleased changes

Scope

• Add a tag-triggered least-privilege release workflow.
• Rerun npm run verify, audit, benchmark policy checks, and npm pack inspection.
• Extract notes from only the matching changelog section.
• Attach the package tarball while leaving npm publication an explicit separate action.
• Document failure recovery without tag rewriting.

Acceptance criteria

• Version, lockfile, tag, and changelog mismatches fail before release creation.
• A valid tag creates exactly one GitHub release with scoped notes and an attached tarball.
• The workflow has only the permissions required to read contents and create the release.
• No npm token is required and no npm publication occurs.
• docs/RELEASING.md matches the automated and manual recovery paths.

Help wanted

Workflow contributions are welcome; release execution and permission approval remain maintainer responsibilities.

---

Generated from the repository maturity assessment dated 2026-07-11. Do not include credentials, customer data, or local-only files in public discussion.