ci(security): make @fuzefront/security-client publishable + installable now (izzywdev alias)

[izzywdev]

What

Makes @fuzefront/security-client (packages/security/) actually publishable and installable so FuzeSocial / Mendys can reintegrate through it.

Changes

• Add packages/security to lerna.json packages[] and to the root workspaces (it was in neither, so lerna change-detection + workspace tooling never saw it).
• Add .github/workflows/security-packages-publish.yml — mirrors the proven chat-packages-publish.yml: on push to master touching packages/security/**, builds the tsup output and publishes to GitHub Packages, idempotently (skips an already-published version). No git push / tag, so master's required_signatures is never involved.

The scope-vs-owner constraint (important)

GitHub Packages ties the npm scope to the repo owner. Under the current izzywdev account, @fuzefront/* cannot publish (403) — which is exactly why packages-publish.yml is gated to github.repository_owner == 'fuzefront' and no-ops today. The finding's suggested "flip that gate to izzywdev and keep the @fuzefront scope" would make lerna publish 403 on every @fuzefront/* package on every master push, so that gate is intentionally left unchanged as the long-term org-transfer path.

Instead we follow the repo's already-established workaround (used for chat packages): publish under the owner-scoped alias @izzywdev/fuzefront-security-client. Consumers install via an npm alias so their imports keep the canonical name:

// consumer package.json
"@fuzefront/security-client": "npm:@izzywdev/fuzefront-security-client@^0.1.0"

with a scoped .npmrc:

@izzywdev:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}

Once the org transfer lands and packages-publish.yml activates, consumers drop the alias and this workflow is deleted.

Signatures / tags

The alias workflow does no git commit/git push/tag — it only npm publishes — so master's required_signatures protection is not touched (unlike a lerna publish version-bump-and-push, which would be rejected on signed-master).

🤖 Generated with Claude Code

[github-actions]

Automated code review (gate-code-review)

Credit balance is too low

Report-only — this check never blocks merge.