feat(registry): add signed plugin publisher

[dviejokfs]

Summary

• add a Bun/TypeScript publisher that signs one plugin release and updates a registry checkout atomically
• verify root trust, current/live signed state, signing-key authorization, immutable artifacts, SemVer ordering, and client size limits before writing
• use one registry manifest version for Deployment Pulse runtime identity and signed catalog metadata
• build separate GNU and musl Linux artifacts for amd64/arm64, plus both macOS architectures
• fail tagged releases unless the tag, TypeScript manifest, and Rust workspace versions match
• add publisher tests and CI type-checking

Requires the matching libc-aware installer selection in gotempsh/temps#728.

The publisher deliberately does not deploy or receive signing secrets in CI. The online catalog key must remain outside both checkouts and be supplied explicitly with mode 0600. Live deployment must be serialized and use compare-and-swap at the registry commit boundary.

Evidence

Publisher behavior and security failure paths

bun test ./scripts/publish-plugin.test.ts

17 pass
0 fail
41 expect() calls

Covers a successful six-platform signed publish, dry-run, immutable republish, stale live state, retired/out-of-window keys, unauthorized and misplaced private keys, symlinked artifacts, SemVer rollback edge cases, chunked response caps, the signed-envelope client limit, unknown CLI flags, and stale lock handling.

Publisher TypeScript and CLI

deployment-pulse-plugin/node_modules/.bin/tsc --project scripts/tsconfig.json
bun scripts/publish-plugin.ts --help

Publish one signed plugin release into a temps-registry checkout.
Usage: bun scripts/publish-plugin.ts --manifest ... --artifacts-dir ... --registry-dir ... --key-id ... --signing-key-file ... [--dry-run]

Reference plugin compatibility

cd deployment-pulse-plugin
bun run test
bun run build
bunx tsc --noEmit

6 pass
0 fail
vite build: 30 modules transformed
bun compile: 15 modules bundled

musl artifact proof

bun build src/index.ts --compile --target=bun-linux-x64-musl --outfile=dist/temps-deployment-pulse-plugin-x86_64-linux-musl
file dist/temps-deployment-pulse-plugin-x86_64-linux-musl

ELF 64-bit LSB executable, x86-64, dynamically linked, interpreter /lib/ld-musl-x86_64.so.1

Workspace compatibility

cargo check --workspace
cargo clippy --all-targets -- -D warnings

cargo check: 0 errors
cargo clippy: 0 errors

Security review

Approved with no blocking, major, or minor findings after the publisher, version-binding, and six-platform changes. No private keys, tokens, or generated secrets are included.