- Add workflow_call trigger to ci.yml so publish can reuse it as a gate
- Replace minimal publish.yml with hardened pipeline:
- Full CI must pass before publish (typecheck + tests + cross-platform)
- Verify git tag matches package.json version
- Explicit build step + dry-run before real publish
- npm provenance attestation enabled
- Auto-create GitHub Release with generated notes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
