fix(ci): repair the GitHub Packages mirror and SEA smoke reliability

.github/workflows/ci.yml

@@ -196,12 +196,25 @@ jobs:
         run: |
           BINARY="${{ steps.build.outputs.binary-path }}"
           chmod +x "$BINARY"
-          # The server runs until signalled; printing its startup banner within a 5s background window is the pass condition.
           "$BINARY" --name sea-smoke > smoke.log 2>&1 &
           PID=$!
-          sleep 5
-          kill "$PID" || true
-          grep -q "REST facade listening" smoke.log
+          # Polled rather than a single fixed sleep: on Windows, start() itself spawns a real subprocess (WinProcInfo's own powershell.exe) before the server ever binds, and that spawn's latency is exactly what the test suite's own REAL_PROCESS_SPAWN_TEST_TIMEOUT_MS headroom already exists to accommodate (confirmed exceeding a naive 5s fixed wait on a real windows-11-arm runner). Exiting the loop the moment the banner appears, or the moment the process itself has died, means a healthy binary is never held to the full deadline and a genuine crash is reported immediately rather than only after the full wait.
+          DEADLINE=$(( $(date +%s) + 20 ))
+          while [ "$(date +%s)" -lt "$DEADLINE" ]; do
+            if grep -q "REST facade listening" smoke.log 2>/dev/null; then
+              kill "$PID" 2>/dev/null || true
+              exit 0
+            fi
+            if ! kill -0 "$PID" 2>/dev/null; then
+              break
+            fi
+            sleep 0.5
+          done
+          kill "$PID" 2>/dev/null || true
+          echo "::group::smoke.log"
+          cat smoke.log
+          echo "::endgroup::"
+          exit 1
 
       - name: Upload the binary as a release asset
         env:
@@ -257,11 +270,12 @@ jobs:
       - name: Build
         if: steps.mirrored.outputs.already != 'true'
         run: pnpm build
-      - name: Rewrite package name and registry for the GitHub Packages scope
-        # GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless.
+      - name: Rewrite package name, version, and registry for the GitHub Packages scope
+        # GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless. version must be set explicitly too: @semantic-release/npm bumps package.json only in the release job's own ephemeral working copy, and with @semantic-release/git absent (see release.config.ts) nothing ever commits that bump back, so the tree checked out here at the release tag still carries source's committed placeholder version rather than the version the tag actually names.
         if: steps.mirrored.outputs.already != 'true'
         run: |
           npm pkg set name="${MIRROR_NAME}"
+          npm pkg set version="${{ steps.tag.outputs.version }}"
           npm pkg set publishConfig.registry="https://npm.pkg.github.com"
           npm pkg set publishConfig.provenance=false --json
       - name: Publish the mirror