Exports affiliationColorOf, which 4.1.0's notes listed under Added and which was
not on the barrel. The function existed and its own module exported it, so it
typechecked, grepped fine and worked internally — no consumer could import it. A
changelog describing a symbol nobody can reach is worse than a patch release.

The release checklist has carried the rule since 1.6.0: assert every release-note
symbol against dist/, not the source, because an export missing from a barrel
passes typecheck and grep. That check ran for 4.0.0's notes and not for 4.1.0's,
and the omission was found by smoke-testing the published tarball rather than by
any gate.

So it is a gate now. publicSurface.test.ts asserts the announced names against the
barrel module itself, and asserts affiliationColorOf actually resolves to a
function returning the affiliation colour rather than the obstacle green — a name
that resolves to undefined is the other half of the same failure. The list is
deliberately hand-kept: one generated from the barrel would agree with the barrel
by construction and could never catch an omission.

Control: deleting the export line again fails both cases, which is exactly what
shipped.