Faster, cheaper CI (velocity sweep)

[0thernet]

Part of the Hraness CI velocity sweep. hraness/direct is public, so Actions minutes are free; this targets wall-clock and release reliability.

What changed

• Concurrent historical-recovery tests. The 12 current tools prepare and smoke exact vX source without tagged helpers tests in scripts/npm-publish-workflow.test.ts now use test.concurrent, capped by an in-file semaphore of 4 (a 4 vCPU runner). Each test already works in its own mkdtemp tree. The per-test timeout rises from 180 s to 600 s because it now includes queue wait. test:npm-release and the CI coverage contract are unchanged.
• Canonical npm verify skips the duplicate bun run check. npm-publish.yml takes a mode input (canonical or mirror, default mirror), and release.yml passes needs.authorize.outputs.mode. In canonical mode the identity step first checks two things: the event is the tag push, and GITHUB_SHA equals the source SHA. It then checks that the mirrored release-manifest.json runId equals this run. After that the verify job skips bun run check, which this run's Verify job already ran on the same commit. Frozen install, generated-tree cleanliness, mirror-verify, and exact-archive package smoke all still run. Current-main mirror retries (mirror mode) still run the full check. AGENTS.md and docs/publishing.md are updated to match.
• Registry propagation wait. The registry job polls npm view "$package_spec" version --prefer-online every 15 s for up to 5 min before npm pack. npm pack and npm view ... dist also use --prefer-online, so npm's packument cache cannot serve a stale document. If the poll times out, it prints the last npm view error. This is a bounded local retry; the planned shared npm-visible action should replace it once that exists.
• CI concurrency. Changed to group: ci-${{ github.event_name == 'pull_request' && github.ref || github.sha }} with cancel-in-progress: ${{ github.event_name == 'pull_request' }}. Each main commit gets its own run and a later push never cancels it. PR runs still cancel superseded heads. The prior-bytes hash contract in ci-source-coverage.test.ts now reverses this change explicitly.
• Example port override (developer convenience, not CI). examples/todos/preview.ts accepts DIRECT_EXAMPLE_PORT (0 to 65535, where 0 picks a free port). It keeps strictPort and prints the address it actually bound. The default stays 5173, so the documented scenario URLs are unchanged.
• Contract test. A new test pins the mode plumbing, the canonical guard, the single allowed step if:, and the poll order: after mirror-verify and before npm pack.

Evidence (before)

• CI, last 12 green pull_request runs (36484179688 … 36018627277): median wall 314 s. Last 12 green push runs (36484904699 … 35955149084): median 292 s. Billed minutes: 0 (public repo).
• bun run check phase log (job 109136904889, run 36484179688): test:npm-release 196.6 s of about 283 s. The 12 historical tests took 14.4 to 16.8 s each and ran serially (about 190 s in total).
• Release v0.7.23, run 36485449131: Verify ran bun run check for 257 s. npm Verify exact package then ran it again on the same source SHA for 272 s. Tag to npm publish took 13.5 min.
• The same run's Verify registry mirror attempt 1 failed with npm error notarget No matching version found for @hraness/direct@0.7.23, 58 s after publish. Attempt 2 passed after a manual re-run.

Expected after

• About 2 to 2.5 min less per bun run check (the historical block drops from about 190 s to about 60 s). That covers the PR, the main push, and release Verify.
• About 4.5 more minutes saved per canonical release, because the npm verify no longer runs a second check.
• No manual re-run for npm propagation lag.
• Main-push CI runs are never cancelled by a later merge.

Observed after (this PR)

• CI run 36528436956: 190 s wall (before: median 314 s for PR runs), check job 180 s.
• The test:npm-release file set ran 51 tests in 95.7 s (before: 196.6 s). The release-side savings (canonical npm verify skipping the second bun run check, about 4.5 min, and the registry poll) show up on the next tag release.

Checks run locally

• actionlint on npm-publish.yml and release.yml is clean. On ci.yml it reports only an SC2066 in the untouched Required job. That finding predates this change, and the job's bytes are pinned by the prior-bytes contract.
• bun test ./scripts/ci-source-coverage.test.ts ./scripts/github-release.test.ts passes.
• bun test ./scripts/npm-publish-workflow.test.ts -t "npm release workflows" passes, including the new test. The existing rechecks the immutable release tag test runs close to its 5 s default timeout on a heavily loaded host; it also does so on main.
• Not run locally, because the host is short on disk: dependency install, typecheck, lint, and the concurrent historical tests. CI on this PR runs the complete bun run check.

🤖 Generated with Claude Code