fix(release): wait for npm propagation

[steipete]

Summary

• wait up to five minutes for npm to expose newly published version, integrity, and latest metadata
• retry only absent propagation metadata while failing conflicting version, integrity, or dist-tag values immediately
• dispatch the Homebrew update from a sibling job gated on successful publication, with the downstream workflow repeating the patient verification
• share the verifier with the local release path and document the recovery behavior

Testing

• pnpm check
• pnpm test
• pnpm exec vitest run tests/verify-npm-publication.test.mjs
• ./scripts/test-release.sh
• actionlint .github/workflows/release.yml .github/workflows/update-homebrew-tap.yml
• live verification against mcporter@0.13.0
• Codex autoreview: clean

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix(release): wait for npm propagation This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9dfd5e6801

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Retry stale latest dist-tag during propagation

When the new version document and integrity have reached npm before the mutable latest tag cache catches up, npm view mcporter dist-tags.latest --json can still legitimately return the previous release; npm dist-tag --help describes these as mutable package distribution tags (“Modify package distribution tags”). Because both the Release and Update Homebrew Tap workflows call this verifier, treating any non-null old latest value as an immediate immutable mismatch makes normal registry propagation fail instead of using the advertised five-minute wait. Retry stale latest until it equals the expected version or the deadline expires.

Useful? React with 👍 / 👎.