ci(release): publish npm from release.yml, not publish-npm.yml

[Mikola Lysenko (mikolalysenko)]

Why

The 5.0.0 release's npm leg failed with E401 Unable to authenticate (run 38311868646). Every npm package's trusted publisher is registered against release.yml, but the leg ran as publish-npm.yml. npm allows only one publisher per package and matches the top-level workflow filename. Nothing was staged.

What

• The npm publish runs inline again as release.yml's npm-publish job, with the same steps as publish-npm.yml: asset download + SHA256SUMS check (digest-pinned on a full run), stage platform packages, then the main package, then the approval summary. It has id-token: write and a per-version concurrency group.
• publish-npm.yml is deleted.
• New npm-retry-version input on Release. It skips the version gate, build, tag, GitHub release and crates.io jobs and re-stages npm from the existing v<version> release, with an integrity-only SHA256SUMS check. It still runs as release.yml, so no trusted-publisher change is needed.
• crates.io is unchanged: still dispatched through publish-cargo.yml (its publisher is being added for both crates).
• docs/releasing.md, the release.yml header, the dispatch-publish.sh comments and one ci.yml comment are updated to match.

After merge

Retry 5.0.0's npm publish: Actions → Release → Run workflow on main with npm-retry-version: 5.0.0, then approve the staged packages with 2FA, platform packages first.

actionlint on release.yml and shellcheck on dispatch-publish.sh pass.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes the release pipeline and npm OIDC workflow identity; mistakes could block or mis-stage npm publishes, but behavior mirrors the deleted workflow and includes retry/idempotency guards.

Overview
Moves npm publishing back into release.yml so OIDC trusted publishing matches npm’s single publisher per package (registered on release.yml, not a separate workflow). The standalone publish-npm.yml is removed; its steps now run in the inline npm-publish job (release asset download, SHA256SUMS pinning on full releases, stage platform + main packages, approval summary), with id-token: write and per-version concurrency.

Adds npm-retry-version on Release to skip build/tag/GitHub release/crates.io and re-stage npm from an existing v<version> release (integrity-only checksum on retry). crates.io is unchanged—still dispatched via publish-cargo.yml. Docs (releasing.md), workflow headers, dispatch-publish.sh comments, and a CI comment are updated accordingly.

^{Reviewed by Cursor Bugbot for commit b8ccf1f. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Final reviewer: re-enqueued once. The merge group's coverage job failed in patch::redirect::upstream::npm::tests::project_registry_decides_a_mirrors_tarball_urls (npm.rs:4072). That test is on main (added in #1466) and isn't touched by this PR. It reads SOCKET_NPM_REGISTRY, which the bun_lockb.rs tests set in the same lib test binary, so the two race when they run in parallel. It passes in isolation on main. The owner has been told; a fix belongs in its own PR.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Superseded by #1485, the combined 5.0.1 release PR, which cherry-picks this commit. 5.0.0 won't be retried on npm; 5.0.1 ships with this fix.