fix(release): synchronize the notifier and tolerate npm propagation

[ty-everett]

Program and scope

The post-publication sync currently misses the separately deployed UHRP notifier, leaving its first-party SDK floor and npm lock behind the service image. Include that explicitly owned directory in manifest reconciliation and lock refresh, and align its deploy scripts with the already-declared Node 24 runtime. Do not recursively traverse unrelated nested projects.

Release run 35818166489 also demonstrated npm metadata propagation beyond the previous five-minute poll window: SDK 2.8.0 appeared just after verification timed out and its actual registry tarball matches the immutable candidate. Allow 41 polls at 15-second intervals and a 90-minute publication job. Exact-byte verification, immutable retry, protected approval, provenance, scans and permission boundaries remain required.

• Coordination: [BotBoard][active] ty-everett / Codex — release readiness and bounded correctness fixes #558
• Program gates: complete standalone consumer graph; reproducible notifier runtime; bounded release reconciliation.
• No public package source or manifest changes. Current npm publication continues from its original candidate; these controls apply after merge.
• The generated post-publication PR will carry the actual infrastructure floors and frozen locks.

Impact

• No public package source or manifest changed
• Infrastructure source, dependency, image, or deployment configuration changed
• Security-sensitive boundary changed
• Documentation or examples changed

Verification

• Passed pnpm health:check, pnpm lint, pnpm format:check, pnpm build, pnpm typecheck, pnpm audit:security, and pnpm docs:build.
• Four notifier tests pass; notifier audit has zero vulnerabilities; both deployment scripts pass bash -n.
• Fourteen focused release-artifact/sync tests pass. The new executable fixture proves notifier inclusion, dry-run and workspace-only isolation, preservation of third-party dependencies, exclusion of arbitrary children, and repeat-run idempotence. It fails against the previous sync script because the notifier is omitted.
• Public package, browser, mobile, conformance, published-byte and bundle contracts do not change.
• Complete diff self-reviewed for correctness, security, compatibility, artifacts, dependency boundaries, documentation and operations.
• Exact-head hosted CI, CodeQL, zero-new-Sonar and review-thread checks complete.

Security and dependencies

• No dependency or lockfile change in this control fix.
• No new override, advisory dismissal, quality suppression, or skipped test.
• Workflow permissions and lifecycle-script denial remain unchanged.
• Exact-head CodeQL has no new alert and repository quality gate has zero new Sonar findings or unreviewed hotspots.

Release and operations

• No npm publication from a workstation or this PR.
• No npm version bump required for these repository/private function deployment controls.
• Runtime, migration, publication, retry, and separate promotion guidance updated.
• Hosted checks and final critical review will be recorded before merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Critical maintainer review of exact head 0cfaebe: no blocking findings.

Reviewed the full nine-file change and its operational boundary. The explicit nested notifier path cannot recursively rewrite unrelated examples or installed dependencies; the executable regression verifies that exclusion, third-party range preservation, dry-run/workspace-only behavior, patch bump and repeat-run idempotence. The final portable test fails against the old sync source. Node 24 matches the function's existing engine contract. Longer publication waits preserve exact-byte conflict rejection, lifecycle-script denial, protected npm approval and all scan/attestation gates; existing publication still uses its original immutable candidate.

All applicable exact-head checks are terminal and successful: CI 35820246831 includes the merge gate, both UHRP/notifier infrastructure lanes, build/lint/policy and docs; CodeQL 35820246830 passes with zero open PR alerts; zero-new-Sonar succeeds; hosted runtime contracts and conformance runner pass. Scope-based package/mutation skips are validated by the strict merge gate. No review threads exist. Required local health/lint/format/build/typecheck/audit/docs and notifier tests/audit pass.

No public package bytes change. The subsequent published-version PR must include the nested notifier's refreshed lock even if generated by the already-running older release workflow. Main acceptance remains required after merge.