fix: stage and validate npm releases within vip-cli

[rebeccahum]

VIP CLI 4.1.2 failed to publish because the bundled cpu-features and ssh2 Linux builds introduced three hard links into the npm archive. The registry rejected it with E415: Hard link is not allowed.

Keep the complete fix in vip-cli. Stable and prerelease publishing now use a repository-local action and scripts; recovery uses the same local packing helper. No changes to Automattic/vip-actions and no dependency on PR #416 in that repository are required.

Release behavior

After building and testing, preparation hooks run in the source checkout. rsync -a without -H copies into a fresh staging directory. The helper packs once with scripts disabled, validates archive paths and package identity, rejects links, and runs smoke:release inside the extracted tarball. Both the dry run and actual publication use that exact .tgz with lifecycle scripts disabled.

Local publishing scripts retain release-PR file/type validation, branch and clean-checkout checks, npm trusted publishing, GitHub release/prerelease creation, selected npm tags, and the stable release's next development-version PR. Failed GitHub PR inspection stops the release. Only the captured npm version command uses silent logging; npm publication errors remain visible.

Recovery saves tools from the workflow revision before checking out the existing release tag. This supports 4.1.2 without adding scripts to or changing its tag. The existing npm-publish environment, workflow identity, permissions and downstream documentation jobs are preserved.

Validation

• Eight local regression tests passed, with additional subcases covering release validation errors and unsafe archive entries. They build actual fixture tarballs; all GitHub publication and npm publication are mocked.
• Publisher integration checks verify identical tarball paths and SHA-256 hashes for dry-run/publication, stable/prerelease tags, and creation of the next development-version PR.
• Reproduced the tagged 4.1.2 package on Linux x64 / Node 24.20.0 using the local helper: three hard links before staging, none afterward; all 14 CLI smoke tests passed against the extracted artifact.
• ShellCheck, actionlint, Prettier and diff checks passed. Added Ubuntu CI for packaging regression tests.
• No npm publication performed. Full Node/Go runtime and parity suites were not run because this changes release orchestration and documentation, not CLI command behavior. The release workflow runs the tagged package's build and tests before staging.

Recovery after merge

Start a new run of Publish to npm (if applicable) on trunk, with release_mode: recover-stable and release_version: 4.1.2. Leave the prerelease npm tag field unchanged. Recovery retains the existing GitHub release/tag. Rerunning the old failed workflow will not pick up this fix.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/npm-publish.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud