Derive published package version from release tags

[ggoodman]

Why

The release pipeline combined two incompatible contracts: main packed the source placeholder version (0.0.0-dev) into the immutable artifact, while the release workflow required the GitHub tag to match that placeholder exactly. A real release therefore required committing a publish version into the development manifest, instead of deriving publish metadata from the release.

The intended contract is the same one used by our other packages: main owns the verified build payload, while the release tag owns the published version.

What changed

• treat the tarball produced by main as an immutable, SHA-bound package payload rather than the final published package
• remove the development version from the artifact manifest and bump its schema so old artifacts fail closed
• derive the package version from the v<semver> release tag
• download and verify the exact target commit's successful main artifact before packaging
• extract that payload, validate its package name, and apply the tag version only to the staged package.json
• repack and publish with lifecycle scripts disabled, so the release cannot rebuild or mutate the code payload
• document the derived-manifest contract and test the workflow invariants

The source package.json remains 0.0.0-dev. The only release-time package-content change is its derived version; the compiled code, declarations, README, and license come from the exact verified main artifact.

Validation

• node scripts/check-github-actions-pinned.ts
• npm run typecheck
• npm test — 9 passing tests
• npm run build
• npm pack --dry-run
• exercised the release shell sequence against an actual immutable package payload and derived @torkbot/code-mode-sandbox@0.1.0
• compared input and release tarballs with package.json excluded — no payload differences
• npm publish <derived tarball> --dry-run --ignore-scripts --access public
• git diff --check

[ggoodman]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 03d2b8c7d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".