test(release): cover release-please API contract

[lamemustafa]

Summary

Adds an installed-package release-please API contract test for the wrapper used by the release workflow.

Root Cause / Decision Record

• The release-please dependency upgrade lacked coverage of Pack's runtime calls to GitHub.create and Manifest.fromManifest.
• The test spies on the installed package's real exports at the network boundary; dependency versions and release behavior are unchanged.
• This PR is required evidence before deciding PR chore(deps-dev): bump release-please from 17.10.1 to 17.11.1 #128; it closes no release or Store gate.

Scope

• Runtime: no behavior change; removes the test-only injection surface.
• Tests: installed-package API contract coverage and its import repair.
• Docs/governance: none.
• Explicitly out of scope: dependency upgrade, extension behavior, portal automation, permissions, release claims, and full-year work.

Pack Workflow Preflight

• pnpm workflow:preflight ran after the intended commits.
• This PR is opened from a Pack branch, not master.
• The current Pack AGENTS guidance was reviewed.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• This PR does not consume @sanchika/* packages or copied Sanchika guidance.
• This PR does not import parent source paths.

Privacy And Data-Flow Impact

• No new browser or host permissions, network calls, analytics, telemetry, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are unchanged.

Sensitive Surface Review

• Portal target binding, download completion, and service-worker durability are unchanged.
• Real taxpayer data, local paths, raw portal URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

• This PR does not expand the Chrome Web Store V0 listing.
• Full fiscal year remains source-build alpha and is not a Store claim.
• CI ZIP creation and protected publishing remain release evidence, not Store sign-off.

Verification

• pnpm workflow:preflight
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• Focused contract test: 5 passed.
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip
• Exact ZIP browser-host verification is blocked locally because pinned Playwright Chromium is unavailable; CI remains required.
• Full Vitest has two known Chrome Web Store asset-export failures; 1,558 tests passed and CI remains required.
• Current-head review gate runs after this draft exists.

Artifact Evidence

• CI run: pending for this head.
• ZIP artifact: local only; not release evidence.
• ZIP SHA-256: recorded only in local verifier output; not release evidence.
• Clean source/tag or head SHA: cc573cf.

PR Review Follow-Up

• GitHub Actions and review-gate complete for the latest head.
• Current-head automated review and review-thread inspection complete.
• No source commits will be pushed after the recorded head without re-review.

Thread/comment	Disposition	Commit or evidence
Current-head findings fixed; CI and review pending	pending	cc573cf

Screenshots

Not applicable: workflow wrapper and tests only.

DCO

• Commits include Signed-off-by: trailers.

[lamemustafa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e70c6bec8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: cc573cf100

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc573cf100

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5da07d2ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

Formatter correction pushed in ea88f57 after the fresh CI identified the over-width assertion. Focused Vitest, repository Prettier check, tsc, and ESLint pass. @codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: ea88f57ae4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

Final validation correction pushed in 8bd2cbd: it applies the pinned Prettier output and types the lower transport seam fail-closed. Focused Vitest, pinned repository Prettier, tsc, ESLint, diff check, and workflow preflight pass. @codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 8bd2cbdb8c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".