Harden npm package release supply chain

[ty-everett]

Summary

• split npm releases into an uncredentialed prepare boundary, a protected exact-artifact publish boundary, and a separately credentialed version-sync job
• stage each unpublished governed package once, verify its immutable tarball digests and Open BSV v6 payload, and publish those exact bytes in dependency order
• generate per-package and aggregate CycloneDX 1.5 SBOMs, enforce a complete production-license inventory, gate high/critical Trivy findings, attest and verify SLSA/CycloneDX evidence, and retain offline bundles
• use npm trusted publishing/OIDC provenance without long-lived npm tokens and verify registry bytes after publication
• add CI dry-run coverage, machine-readable policy, recovery/consumer verification documentation, and repository-health regression tests

Tracks #324 (Wave 6 npm package-artifact supply-chain hardening).

Validation

• pnpm build
• pnpm typecheck
• pnpm lint
• pnpm format:check
• pnpm audit:security
• pnpm health:check
• checksum-verified actionlint 1.7.12 on ci.yml and release.yaml
• all 30 public packages staged and verified: 30 tarballs, 30 package SBOMs, 330 aggregate components, no license-policy findings
• Trivy 0.70.0 aggregate SBOM scan: 0 HIGH/CRITICAL vulnerabilities
• exact SDK tarball npm publish --dry-run --force: pass
• real npm selection: 30 current versions queried, 0 unpublished, no publication performed

This PR does not change package versions, create a release tag, trigger the release workflow, or publish to npm.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!