fix: skip already-published exact package versions

[anandpant]

Summary

• Check each exact package version instead of comparing against npm's moving latest tag. All 15 packages at 0.6.1 already exist; the old check attempted to republish them after latest advanced to 0.12.1.
• Fail closed on registry errors and recheck the pending set before packing/publishing.
• Log npm selection and verify the supported OIDC client minimum. No credentials, npmrc, account or trusted-publisher changes.

Evidence

• The latest-tag comparison predates the mise migration. The two preceding Release runs skipped publishing; their green status did not prove publisher authentication.
• Runner PATH selects Node 24.21.0's bundled npm 11.19.0, above the npm 11.5.1 OIDC minimum. The old runner did not log npm's version directly; this PR adds that receipt.
• Four regression tests pass. Live read-only registry check returns should_release=false. Fully mocked installed-npm OIDC contract probe passes without generated npmrc.

No publish retry or manual deployment. Coordinator review requested; do not merge automatically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nyrra-emulate-web	Ready	Preview	Oct 10, 2026 5:19am UTC