ci: test the shipped package, lint workflows, rescan on acceptance, verify publishes

[askalf]

What this changes

This is the CI half of #208, which was closed before it landed. It's rebased onto master after the 0.10.4 release (#209) and has no release bump of its own.

I reviewed every workflow. All recent runs were green, and everything passes actionlint and shellcheck, so the gaps were in what CI never checked:

Workflow	Change	Why
ci.yml	New package job: installs the npm pack tarball into an empty project (ubuntu + windows, node 20), then runs the installed CLI, truecopy-mcp and the library	The test suite imports ./src straight from the checkout, so a broken published package was invisible
ci.yml	Node 24 added to the matrix	Active LTS, and what publish.yml already uses
ci.yml	New actionlint job, with the binary pinned by version and sha256	Lints every workflow, and every run: script through shellcheck
marketplace-watch.yml	Also runs on master pushes that touch acceptances or detection; runs are serialized	#207 merged 40 minutes after the run that flagged its skill, so the badge stayed red until a manual dispatch. Every run also force-pushes watch, so two runs must never overlap.
publish.yml	After npm publish: install that version back from the registry, check --version, check it flags the poisoned demo, run npm audit signatures	A green publish only means npm accepted the upload
truecopy-gate.yml	verify-attestation: 'true'	The self-gate now checks the Sigstore provenance of the tarball it installs
codeql.yml	Adds the actions language	CodeQL also scans the workflows themselves
docker.yml	Also runs when truecopy.lock or demo/clean-mcp.json change	Both are copied into the image, and its smoke test verifies them
test/release-hygiene.test.mjs	Checks that the CHANGELOG section, lockfile version and documented pins all match package.json	Catches a version bump that leaves any of them behind

Bug fix: truecopy --version printed the usage text and exited 2, even though both issue templates ask reporters for its output. The just-published 0.10.4 still does this. --version, -v and version now print the version. Regression test added, and the CHANGELOG entry is under [Unreleased].

Why

CI tested the source tree but not the package users install. It also didn't confirm a publish was actually usable, and it left the watch badge red after a triage PR merged.

How it was verified

• npm test: 274 tests, 273 pass, 0 fail, 1 skipped (Node 22). Before the new tests, the suite also passed on Node 24.21.0 locally.
• actionlint 1.7.12 with shellcheck 0.11.0: clean on all workflows
• I ran the package job's two scripts locally, taken straight from ci.yml. The installed CLI reports its version, the clean demo passes, the poisoned demo exits 1, verify passes, truecopy-mcp lists truecopy-verify, truecopy-status, and the library has 33 exports.
• npm audit signatures against the published @askalf/truecopy@0.10.3: 1 verified registry signature, 1 verified attestation
• The v0.10.3 release tarball has a Sigstore attestation, so the gate's verify-attestation has something to verify
• Detection change? N/A
• Acceptance change? N/A

🤖 Generated with Claude Code

https://claude.ai/code/session_01XZEotnWUeFC5V4AHMKBM9W

---

Generated by Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[askalf]

Replaced by #211: the same change as one commit, without the model attribution in the commit trailers and body, and with the em dashes in the added text rewritten.