Fix immutable npm release recovery after registry visibility delays

[Iktahana]

Summary

npm accepted a 2.1.0 upload before its registry metadata became visible, stopping the release. Poll visibility for up to ten minutes without repeating uploads, and keep checksum conflicts and registry errors fatal. Recovery loads repaired tooling separately from the original candidate and reuses its saved versions, SHA, and tarballs. Publisher-only repairs no longer select new package versions.

Related issue

#89

Validation

• Ten release artifact and version policy regression tests passed, including executable entry point syntax checks.
• actionlint .github/workflows/release.yml and git diff --check passed.
• Original CI artifact dry run against source 5e292f72794754d5318238b52a9ce19b6a356d58: eight pending artifacts, three identical registry artifacts retained.
• Version calculation against the original candidate selects no new package releases.

Checklist

• Focused orchestration repair; package bytes remain unchanged.
• Regression tests and recovery documentation updated.
• Relevant local checks passed.
• No credentials or sensitive data added.
• No Changeset required: no published package content changes.

Notes for reviewers

Resume failed run 34732994168 with its original immutable artifact only after this repair passes CI and merges. The mixed intermediate commit ee73e47 is superseded by the reviewed final branch.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!