fix: review hardening — provider correctness, write-path tests, release safety

[saby1101]

Everything from the five-agent review that was ready to act on. Replaces #20, #21 and #22, which were the same work split across three reviews for no good reason.

Three commits, kept separate for bisect: correctness fixes, then the tests, then the release workflow.

Correctness (5078b8a)

GCS getAsStream resolved for missing objects. return gcsfile.createReadStream() did no I/O before returning, so the 404 arrived later as a stream 'error'. Every other provider rejects. A caller doing reply.send(await getAsStream(k)) sent a 200 with a broken body, or died on an unhandled 'error'. GCS is the production backend — this was the only finding with live exposure. Now checks existence first.

Dispatch accepted Object.prototype names. Configure[opts.type] walked the prototype chain:

type="toString"    -> registered, FileStore=UNDEFINED
type="constructor" -> registered, FileStore=UNDEFINED

A typo booted clean with nothing decorated. Guarded with hasOwnProperty.call — Object.hasOwn needs ES2022 and lib is ES2020; widening that is not a bug fix's business.

streamToBuffer could hang forever. A stream destroyed without an error emits only 'close', leaving the promise pending and hanging whichever request awaited getAsBuffer. Now rejects, with a settled guard so late events cannot settle twice.

Dead branch on local reads, and the tests that enshrined it. if (await fs.promises.stat(p)) can never be falsy, so File not found was unreachable and callers got raw ENOENT. Two specs reached it only by mocking stat to resolve undefined — a state the real filesystem never produces — asserting an error the code cannot throw, purely to satisfy the coverage threshold. getAsBuffer now reads directly; getAsStream keeps its stat deliberately, since createReadStream is lazy like the GCS reader.

Tests (2b57363)

Write failures were never asserted. Every write test checked a mock's arguments then resolved. Nothing fed a rejected write, so .catch(() => undefined) on any provider's write left the suite green. Six such mutations survived; two re-run here:

S3 save + .catch(() => undefined)       -> 1 test failed  (was: survived)
Azure Buffer.from(data,"utf8")->"ascii" -> 1 test failed  (was: survived)

no-floating-promises catches a dropped await, not a swallowed rejection — lint was never the backstop.

Adds a rejection test per write method across all providers, asserts Azure's getContainerClient argument (nothing checked it, so every operation could have targeted the wrong container), and covers unicode payloads — every fixture was ASCII, which is why the ascii mutation passed.

MinIO now runs in CI, and the integration spec reads a missing key — the real GetObject 404 path, the class of error the mocks cannot see and that #9 was about. 6 → 9 integration tests.

Started as a step, not a service container: services: cannot pass a command and the image needs server /data. My first attempt used bitnami/minio as a service, which would have failed — that image no longer exists on Docker Hub.

Release safety (1411ce9)

The trigger was wrong for drafts. types: [created] fires when a draft is saved (publishing from the default branch before the tag exists) and does not fire when that draft is released. Every release so far was created and published in one action, which is why it never bit — one click on "Save draft" breaks it both ways. Now [published].

Tag and version could disagree silently. A guard now fails the job when they differ; the tag is passed via env: rather than interpolated, so there is no injection surface.

publishConfig.registry pins GitHub Packages — CI only worked because setup-node writes the runner .npmrc; a local publish would target npmjs.org.

Verification

lint     clean
build    clean
tests    149 passed, 100% statements/branches/functions/lines
minio    9 passed against a real container

Source restored bit-identical after the mutation runs.

Deliberately not included

Bucket-existence probe. A renamed or misconfigured bucket makes every object read as missing — the silent-data-loss shape. HeadBucket at boot would catch it, but a pod with object-level IAM and no bucket-level permission would then fail to boot. Fail-vs-warn is a deployment decision, not a fix.

Local backend tidy — traversal guard, atomic writes, ENOTDIR and contentType parity. PLATFORM is unset in every manifest, so LocalFileStore is dev-only.