Record verified SDK 2.8.7 and Toolbox 2.14.2 publications

[ty-everett]

The protected release published SDK 2.8.7 and all three Wallet Toolbox 2.14.2 packages. Record those verified npm baselines, plus the separately published Message Box Client 2.5.4, so the release ledger no longer describes them as pending patches. Regenerate the package migration table from that ledger. No package bytes, dependencies or runtime behavior change.

Program and scope

• Tracker: publication following fix(sdk,wallet-toolbox): honor identity overlay matching in discoverByAttributes #617 and fix: align identity search tokens and phrases before publication #625; BotBoard [BotBoard][closed] ty-everett / wallet-release-ci — packages published and owned-wallet releases handed off #622.
• Exact head: 45917ba.
• Out of scope: automated workspace-floor sync chore(infra): sync image locks to SDK 2.8.8 #614, infrastructure deployments, and further publication.

Verification

• Protected release 36100947184 completed successfully from 029831e, including post-release registry verification and version-sync jobs.
• Independently verified all four tarball SHA-256/SHA-512 values against the immutable release manifest, registry latest tags, npm provenance source/run, and cryptographic GitHub build/SBOM attestations. Message Box Client 2.5.4 independently matches release 36082996765 at source 231eace.
• Local: pnpm health:check, lint, format:check, typecheck, docs:packages:check, workspace build and git diff --check pass.
• No runtime source, exports, wire format, dependency, lockfile, bundle, performance or coverage change. Existing immutable release validation remains applicable: 48 createAction/accounting wire cases, 108 signed identity cases per client/mobile package, and eight real-key payment/refund cases without network spending.
• Complete diff self-reviewed for correctness, compatibility, documentation and operations.
• Exact-head hosted CI 36103665524, CodeQL 36103665471 and conformance 36103665529 succeeded. Documentation-only scope skips are validated by the successful merge gate.

Security and dependencies

• No dependency or lockfile change; no new override, suppression, advisory dismissal or skipped test.
• No trust boundary or workflow permissions changed.
• Exact-head hosted CodeQL and zero-new-Sonar-findings repository quality gate verified; no open PR CodeQL alerts.

Release and completion

• No workstation publication; this PR records already verified protected publication.
• Generated documentation is current and package release summaries/migration guidance are preserved.
• No unresolved review conversations; all applicable hosted checks successful before merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud