Complete npm release readiness and integration gates

[Lauritz-Timm]

What changed

• Harden the tagged publish workflow for signed/notarized macOS artifacts, Azure Artifact Signing on Windows x64/ARM64, exact artifact verification, npm provenance, and fail-closed staging.
• Add a clean, commit-bound manual release-candidate flow that builds and retains one exact tarball, verifies hashes, installs through a loopback-only registry, and bypasses stale OpenCode cache entries with a unique npm alias.
• Exercise the retained package through both the native GUI and PTY-backed TUI with a global model/High effort selection plus a distinct per-task model/Medium override.
• Restore and enforce the declared minimum OpenCode 1.18.7 package/type contract, including notices and Dependabot policy.
• Add immutable GitHub OIDC readiness checks and a permanent, main-only, environment-bound, secretless verification workflow.
• Tighten native picker asset allowlisting, symlink handling, atomic candidate promotion, release-source tracking, documentation, and regression coverage.

Why

This closes the remaining gaps between a locally working plugin and a release process that is reproducible, reviewable, cross-platform, and safe to run for the first public npm release. A failed preparation no longer leaves a usable candidate, and OpenCode's global package cache can no longer make the manual evidence accidentally test older bytes.

Validation

• bun test: 278 passed, 0 failed, 1,845 assertions across 34 files.
• Coverage gate: 82.99% line coverage (80% required).
• Root TypeScript typecheck and package declaration check passed.
• Installed tarball passed isolated Node and Bun consumer tests through the loopback registry.
• Real OpenCode 1.18.7 normal dispatch and concurrent same-agent FIFO integration passed.
• Rendered Firefox picker test passed all 81 style/layout/keyboard assertions.
• Picker frontend, native Linux x64 Tauri build, ELF/linkage check, and locked Rust tests (3/3) passed.
• A clean clone prepared the retained candidate and proved a fresh unique-alias OpenCode installation fetched its exact tarball.
• The exact retained tarball passed both Xvfb/Openbox native GUI and PTY-TUI flows with global child-model/High and row override second-child-model/Medium, including persisted metadata and child-session state.
• Workflow YAML parsing, embedded shell linting, focused release tests, and an independent final patch review passed.

Deliberately not done here

No signing/publishing secrets were added, no GitHub release environments were configured, no tag was created, and nothing was published to npm or GitHub Releases. Those external settings and the actual release remain a maintainer step after this code is merged and CI is green.